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I.  Introduction 

Computer  reasoning  programs  usually  construct  computational  models  of  situations.  To 
keep  these  models  consistent  with  new  information  and  changes  In  the  situations  being 
modelled,  the  reasoning  programs  frequently  need  to  remove  or  change  portions  of  their 
models  These  changes  sometimes  lead  to  further  changes,  for  the  reasoner  often  constructs 
some  parts  of  the  model  by  making  inferences  from  other  parts  of  the  model  This  paper 
studies  both  the  problem  of  how  to  make  changes  In  computational  models,  and  the 
underlying  problem  of  how  the  models  should  be  constructed  In  order  to  make  making 
changes  convenient  Our  approach  is  to  record  the  reasons  for  believing  or  using  each 
program  belief,  inference  rule,  or  procedure  To  allow  new  information  to  displace  previous 
conclusions,  we  employ  'non  monotonic*  reasons  for  beliefs.  In  which  one  belief  depends  on 
a  lack  of  belief  In  some  other  statement  We  use  a  program  called  the  Truth  Maintenance 
System*  (TMS)  to  determine  the  current  set  of  beliefs  from  the  current  set  of  reasons,  and  to 
update  the  current  set  of  beliefs  In  accord  with  new  reasons  In  a  (usually)  Incremental 
fashion  To  perform  these  revisions,  (he  TMS  traces  the  reasons  for  beliefs  to  find  the 
consequences  of  changes  in  the  set  of  assumptions 

I  I  The  Essence  of  the  Theory 

Many  treatments  of  formal  and  informal  reasoning  In  mathematical  logic  and  artificial 
intelligence  have  been  shaped  in  large  part  by  a  seldom  acknowledged  view  the  view  that 
the  process  of  reasoning  is  the  process  of  deriving  new  knowledge  from  old,  the  process  of 
discovering  new  truths  contained  In  known  truths  This  view,  as  It  Is  simply  understood, 
has  several  severe  difficulties  as  a  theory  of  reasoning  In  this  section.  I  propose  another, 
quite  different  view  about  the  nature  of  reasoning  I  incorporate  some  new  concepts  Into 
this  view,  and  the  combination  overcomes  the  problems  exhibited  by  the  conventional  view. 

Briefly  put.  the  problems  with  the  conventional  view  of  reasoning  stem  from  the 
monotonutty  of  the  sequence  of  states  of  the  reasoner 's  beliefs  his  beliefs  are  true,  and  truths 
never  change,  so  the  only  action  of  reasoning  is  to  augment  the  current  set  of  beliefs  with 
more  beliefs  This  monotonktty  leads  to  three  closely  related  problems  Involving 
common  sense  reasoning,  the  frame  problem,  and  control  To  some  extent,  my  criticisms  here 
of  the  conventional  view  of  reasoning  will  be  amplifications  of  Minsky's  |36l  criticisms  of 


I  As  we  shall  see.  this  term  not  only  sounds  like  Orwellian  New  speak,  but  also  1s  probably 
a  misnomer  Thr  name  stems  from  historical  accident,  and  rather  than  change  It  here,  f 
retain  It  to  avoid  confusion  In  the  literature 
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the  logistic  approach  to  problem  solving. 

One  readily  lecalls  examples  of  the  ease  with  which  we  resolve  apparent 
contradictions  involving  our  commonsense  beliefs  alxxit  the  world  For  example,  we 
routinely  make  assumptions  about  the  permanence  of  objects  and  the  typical  features  or 
properties  of  objects,  yet  we  smoothly  accommodate  corrections  to  the  assumptions  and  can 
quickly  explain  our  errors  away  In  such  cases,  we  discard  old  conclusions  in  favor  of  new 
evidence  Thus,  the  set  of  our  commonsense  beliefs  changes  non  monotonically 

Our  beliefs  of  what  is  current  also  change  non -monotonically  If  we  divide  the 
trajectory  of  the  temporally  evolving  set  of  beliefs  Into  discrete  temporal  situations,  then  at 
each  instant  the  most  recent  situation  is  the  set  of  current  beliefs,  and  the  preceding 
situations  are  past  sets  of  beliefs  Adjacent  sets  of  beliefs  in  this  trajectory  are  usually  closely 
related,  as  most  of  our  actions  have  only  a  relatively  small  set  of  effects  The  important 
point  is  that  the  trajectory  does  not  form  a  sequence  of  monotonically  increasing  sets  of 
beliefs,  since  many  actions  change  what  we  expect  is  true  in  the  world  Since  we  base  our 
actions  on  what  we  currently  believe,  we  must  continually  update  our  current  set  of  beliefs 
The  problem  of  describing  and  jserfoming  this  ujsdattng  efficiently  is  sometimes  called  the 
frame  problem  In  connection  with  the  frame  problem,  the  conventional  view  suffers  not 
only  from  monotonicity,  but  also  from  atomicity,  as  It  encourages  viewing  each  belief  as  an 
isolated  statement,  related  to  other  beliefs  only  through  Its  semantics  Since  the  semantics  of 
beliefs  are  usually  not  explicitly  represented  in  the  system.  If  they  occur  there  at  all. 
atomicity  means  that  these  incremental  changes  in  the  set  of  current  beliefs  are  difficult  to 
compute 

The  third  problem  with  the  conventional  view  actually  subsumes  the  problem  of 
commonsense  reasoning  and  the  frame  problem  The  problem  of  control  is  the  problem  of 
deciding  what  to  do  next  Rather  than  make  this  choice  blindly,  many  have  suggested  that 
we  might  apply  the  reasoner  to  this  task  as  well,  to  make  inferences  about  which  inferences 
to  make  This  approach  to  the  problem  of  control  has  not  been  explored  much,  in  part 
because  such  control  inferences  are  useless  in  monotonic  systems  In  these  systems,  adding 
more  Inference  rules  or  axioms  just  increases  the  number  of  Inferences  possible,  rather  than 
preventing  some  inferences  fiom  being  made  One  gets  the  unwanted  inferences  together 
with  new  conclusions  confirming  their  undeslreability 

Rather  than  give  it  up.  we  pursue  this  otherwise  attractive  approach,  and  make 
the  deliberation  required  to  choose  actions  a  form  of  reasoning  as  well  For  our  purposes, 
we  lake  the  desires  and  intentions  of  the  reasoner  to  be  represented  In  his  set  of  current 
beliefs  as  beliefs  about  his  own  desires  and  Intention  We  also  take  the  set  of  inference  rules 
by  which  the  reasoning  process  occurs  to  be  represented  as  beliefs  about  the  reasoner 's  own 
computational  structure  By  using  this  self-referential,  reflexive  representation  of  the 
reasoner,  the  inference  rules  become  rules  for  self-modlflcatlon  of  the  reasonrr's  set  of  beliefs 
(and  hence  his  desires  and  intentions  as  well)  The  control  problem  of  choosing  which 
inference  rule  to  follow  takes  the  form  ‘Look  at  yourself  as  an  object  (as  a  set  of  beliefs),  and 
choose  what  (new  set  of  beliefs)  you  would  like  to  become  * 

The  language  of  such  inference  rules,  and  the  language  for  evaluating  which 
self  change  to  make,  are  for  the  most  part  outside  the  language  of  inference  rules 


encouraged  by  the  conventional  view  of  reasoning  For  example,  when  the  current  set  of 
beliefs  is  inconsistent,  one  uses  rules  like  "Reject  the  smallest  set  of  beliefs  possible  to  restore 
consistency"  and  "Reject  those  beliefs  which  represent  the  simplest  explanation  of  the 
inconsistency  "  These  sorts  of  rules  are  all  we  have,  since  we  cannot  Infallibly  analyte  errors 
or  predict  the  future,  yet  these  rules  are  non  monotonic,  since  they  lead  to  removing  beliefs 
from  the  set  of  current  beliefs 

To  repeat,  one  source  of  each  of  these  problems  Is  the  monotontdty  Inherent  In 
the  conventional  view  of  reasoning  I  now  propose  a  different  view,  and  some  new  concepts 
which  have  far  reaching  consequences  for  these  issues 

Rational  rtougtt  It  the  proem  of  finding  reasons  for  attitudes 

To  say  that  some  attitude  (such  as  belief,  desire,  intent,  or  action)  is  rational  It  to  say  that 
there  is  some  acceptable  reason  for  holding  that  attitude  Rational  thought  Is  the  process  of 
finding  such  acceptable  reasons  Whatevei  purposes  the  reasoner  may  have,  such  at 
solving  problems,  finding  answers,  or  taking  action,  it  operates  by  constructing  reasons  for 
believing  things,  desiring  things,  intending  things,  or  doing  or  willing  things  The  actual 
attitude  in  the  reasoner  occurs  only  as  a  by  product  of  constructing  reasons  The  current  set 
of  beliefs  and  desires  arises  from  the  current  set  of  reasons  for  beliefs  and  desires,  reasons 
phrased  In  terms  of  other  beliefs  and  desires  When  action  Is  taken,  it  Is  because  some 
reason  for  the  actio  1  can  be  found  in  terms  of  the  beliefs  and  desires  of  the  actor.  I  stress 
again,  the  only  real  component  of  thought  is  the  current  set  of  reasons  *  the  attitudes  such 
as  beliefs  and  desires  arise  from  the  set  of  reasons,  and  have  no  independent  existence 

One  consequence  of  this  view  is  that  to  study  rational  thought,  we  should  study 
Justified  belief  or  reasoned  argument,  and  ignore  questions  of  truth  Truth  enters  into  the 
study  of  extra  psychological  rationality  and  into  what  commonsense  truisms  we  decide  to 
supply  to  our  programs,  but  truth  does  not  enter  into  the  narrowly  psychological  rationality 
by  which  our  programs  operate 

Of  course,  this  sort  of  basic  rationality  Is  simpler  to  realize  than  human  belief. 
Humans  exhibit  "burn  in*  phenomena  in  which  long  standing  beliefs  come  to  be  believed 
Independently  of  their  reasons,  and  humans  sometimes  undertake  "leaps  of  faith"  which 
vault  them  into  self  Justifying  sets  of  beliefs,  but  we  will  not  study  these  issues  here.  Instead, 
we  restrict  ourselves  to  the  more  modest  goal  of  making  rational  programs  In  (his  simpler 
sense 

The  view  staled  above  entails  that  for  each  statement  or  proposition  P  Just  one  of 
two  states  nhtatns  Either 

(A)  P  has  at  least  one  currently  acceptable  {valid)  reason,  and  Is  thus  a  member  of  the 
current  set  of  beliefs,  or 

(B)  P  has  no  currently  acceptable  reasons  (either  no  reasons  at  all.  or  only  unacceptable 
ones),  and  Is  thus  not  a  member  of  the  current  set  of  beliefs 
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If  P  falls  In  stair  (A),  we  say  (hat  P  is  in  (the  current  set  of  beliefs),  and  otherwise,  that  P  Is 
our  (of  the  current  set  of  beliefs)  These  states  are  not  symmetric,  for  while  reasons  can  be 
constructed  to  make  P  in,  no  reason  can  make  P  out  (At  most,  it  can  make  -P  in  as  well ) 

This  shows  that  the  proposed  view  also  succumbs  to  monotonicity  problems,  for 
the  set  of  reasons  grows  monoton ically.  which  (with  the  normal  sense  of  ’reason*)  leads  to 
only  monotonk  Increases  in  the  set  of  current  beliefs  To  solve  the  problem  of  monotonicity, 
are  Introduce  novel  meanings  for  the  terms  'a  reason*  and  ’an  assumption  ’ 

Traditionally,  a  reason  for  a  belief  consists  of  a  set  of  other  beliefs,  such  that  if 
each  of  these  basis  beliefs  is  held,  so  also  is  the  reasoned  belief  To  get  off  the  ground,  this 
analysis  of  reasons  requires  either  circular  arguments  between  beliefs  (and  the  appropriate 
initial  state  of  belief)  or  some  fundamental  type  of  belief  which  grounds  all  other  arguments 
The  traditional  view  takes  these  fundamental  beliefs,  often  called  assumptions  (or  premises), 
as  believed  without  reason  On  this  view,  the  reasoner  makes  changes  in  the  the  current  set 
of  beliefs  by  removing  some  of  the  current  assumptions  and  adding  some  new  ones 

To  conform  with  the  proposed  view,  we  introduce  meanings  for  ’reason*  and 
’assumption*  such  that  assumptions  also  have  reasons  A  reason  (or  |us(ification)  for  a 
belief  consists  of  an  ordered  pair  of  sets  of  other  beliefs,  such  that  the  reasoned  belief  is  in 
by  virtue  of  this  reason  only  if  each  belief  in  the  first  set  is  in,  and  each  belief  in  the  second 
set  is  out  An  assumption  is  a  current  belief  one  of  whose  valid  reasons  depends  on  a 
non-current  belief,  that  is,  has  a  non  empty  second  set  of  antecedent  beliefs  With  these 
notions  we  can  create  ’ungrounded’  yet  reasoned  beliefs  by  making  assumptions  (Eg  give 
P  the  reason  ((l.(-'PJ) )  We  can  also  effect  non  monotonic  changes  in  the  set  of  current 
beliefs  by  giving  reasons  for  some  of  the  out  statements  used  In  the  reasons  for  current 
assumptions  (Eg  to  get  rid  of  P.  justify  -P )  We  somewhat  loosely  say  that  when  we 
justify  some  out  belief  supporting  an  assumption,  (eg  -P).  we  are  denying  or  retracting  the 
assumption  (P) 

These  new  notions  solve  the  monotonicity  problem  Following  from  this  solution 
we  find  wayi  of  treating  the  commonsense  reasoning,  frame,  and  control  problems  plaguing 
the  conventional  view  of  reasoning  Commonsense  default  expectations  we  represent  as 
new-style  assumptions  Part  of  the  frame  problem,  namely  how  to  non  monotontcally 
change  the  set  of  current  beliefs,  follows  from  this  non*monotonk  notion  of  reason 
However,  much  of  the  frame  problem  (eg  how  to  give  the  Taws  of  motion*  and  how  to 
retrieve  them  efficiently)  lies  outside  the  scope  of  this  discussion  The  control  problem  can 
be  dealt  with  partially  by  embedding  the  sequence  of  procedural  states  of  the  reasoner  In 
patterns  of  assumptions  We  will  treat  this  Idea,  and  the  rest  of  the  control  problem.  In 
more  detail  later 

Other  advantages  over  the  conventional  view  also  follow  One  of  these 
advantages  involves  how  the  reasoner  retracts  assumptions  With  the  traditional  notion  of 
assumption,  retracting  assumptions  was  unreasoned  If  the  reasoner  removed  an  assumption 
from  the  current  set  of  beliefs,  the  assumption  remained  out  until  the  reasoner  specifically 
put  It  back  Into  the  set  of  current  beliefs,  even  If  changing  circumstances  obviated  the  value 
of  removing  this  belief  The  new  notions  introduce  instead  the  reasoned  retraction  of 
assumpfions  This  means  that  the  reasoner  retracts  an  assumption  only  by  giving  a  reason 


for  why  it  should  hr  retracted  If  later  this  reason  becomes  invalid,  then  the  retraction  it  no 
longer  effective  and  the  assumption  is  restored  to  the  current  set  of  beliefs 

The  reasoned  retraction  of  assumptions  helps  in  formulating  a  class  of 
backtracking  procedures  which  revise  the  set  of  current  assumptions  when  Inconsistencies 
are  discovered  The  paradigm  procedure  of  this  sort  we  call  dependency  directed 
backtracking  alter  Stallman  and  Sussman  [f>3]  It  is  the  least  specialized  procedure  for 
revising  the  ctitrent  set  of  assumptions  in  the  sense  that  it  only  operates  on  the  reasons  for 
beliefs,  not  on  the  form  or  content  of  the  beliefs  In  short,  it  traces  backwards  through  the 
reasons  for  the  conflicting  beliefs,  finds  the  set  of  assumptions  reached  in  this  way.  and  then 
retracts  one  of  the  assumptions  with  a  reason  involving  the  other  assumptions  (We 
describe  the  procedure  in  detail  later)  Dependency-directed  backtracking  serves  as  a 
template  for  more  specialned  revision  procedures  These  specialized  procedures  are 
necessary  in  almost  all  practical  applications,  and  go  beyond  the  general  procedure  by 
taking  the  form  of  the  beliefs  they  examine  into  account  when  choosing  which  assumption 
to  reject 

I  ?  Basic  Terminology 

The  TMS  records  and  maintains  arguments  for  potential  program  beliefs,  so  as  to 
distinguish  at  all  times,  the  current  set  of  program  beliefs  It  manipulates  two  data 
structures  node i.  which  represent  beliefs,  and  piittfuationi,  which  represent  reasons  for 
beliefs  We  write  M(N)  in  denote  the  statement  of  the  potential  belief  represented  by  the 
node  N  We  say  the  TMS  believes  in  (the  potential  belief  represented  by)  a  node  tf  it  has 
an  argument  for  the  node  and  believes  in  the  nodes  involved  in  the  argument  This  may 
seem  circular  but  some  nodes  will  have  arguments  which  involve  no  other  believed  nodes, 
and  so  form  the  base  step  for  the  definition 

As  us  fundamental  actions.  (I)  (he  TMS  can  create  a  new  node,  to  which  the 
problem  solving  ptogram  using  the  TMS  can  attach  the  statement  of  a  belief  (or  inference 
rule,  or  procedure,  or  data  structuie)  The  TMS  ieaves  all  manipulation  of  the  statements 
of  nodes  (for  inference  representation,  etc)  to  the  program  using  the  TMS  (2)  It  can  add 
(or  retract)  a  new  justification  for  a  node,  to  represent  a  step  of  an  argument  for  the  belief 
represented  by  the  node  This  argument  step  usually  represents  the  application  of  some  rule 
or  procedure  in  the  problem  solving  program  Usually,  the  rules  or  procedures  also  have 
TMS  nodes,  which  they  include  in  the  justifications  they  create  (3)  Finally,  the  TMS  can 
mark  a  node  as  a  contradiction.  to  represent  the  inconsistency  of  any  set  of  beliefs  which 
enter  into  an  argument  for  the  nocie 

A  new  justification  for  a  node  may  lead  the  TMS  to  believe  in  the  node.  If  the 
TMS  did  not  helievr  in  the  node  previously,  this  may  In  turn  allow  other  nodes  to  be 
believed  by  previously  existing  but  incomplete  arguments  In  this  case,  the  TMS  invokes 
the  truth  "lointmartct  procedure  to  make  any  necessary  revisions  in  the  set  of  beliefs  The 
TMS  revises  the  current  set  of  beliefs  by  using  the  recorded  justifications  to  compute 
non-circular  arguments  for  nodes  from  premises  and  other  special  nodes,  as  described  later. 
These  non  similar  arguments  distinguish  one  justification  as  the  we//-/  nrferf  supporting 


justification  of  each  nod*  representing  a  current  belief  The  TMS  locate*  the  set  of  nodes  to 
update  by  finding  those  nodes  whose  well  founded  arguments  depend  on  changed  nodes 

The  program  using  the  TMS  can  indicate  the  inconsistency  of  the  beliefs 
represented  by  certain  currently  believed  nodes  by  using  these  nodes  in  an  argument  for  a 
new  node,  and  by  then  marking  the  new  node  as  a  contradiction  When  this  happens, 
another  process  of  the  TMS.  dependency-directed  backtracking,  analytes  the  well-founded 
argument  of  the  contradiction  node  to  locate  the  assumption r  (special  types  of  nodes  defined 
later)  occurring  In  the  argument  It  then  makes  a  record  of  the  inconsistency  of  this  set  of 
assumptions,  and  uses  this  record  to  change  one  of  the  assumptions  After  this  change,  the 
contradiction  node  is  no  longer  believed  We  explain  this  process  in  Section  1 

The  TMS  employs  a  special  type  of  justification,  called  a  non  monotonic 
Justification,  to  make  tenative  guesses  A  non  monotonic  justification  bases  an  argument  for 
a  node  not  only  on  current  belief  in  other  nodes,  as  occurs  in  the  most  familiar  forms  of 
deduction  and  reasoning,  but  also  on  lack  of  current  belief  in  other  nodes  For  example, 
one  might  justify  a  node  N-l  representing  a  statement  P  on  the  basis  of  lack  of  belief  In 
node  N-2  representing  the  statement  -P  In  this  case,  the  TMS  would  hold  N-l  as  a 
current  belief  as  long  at  N-2  was  not  among  the  current  beliefs,  and  we  would  say  that  It 
had  assumed  belief  in  N-l  More  generally,  by  an  assumption  we  mean  any  node  whose 
well  founded  support  is  a  non  monotonic  justification 

As  a  small  example  of  the  use  of  the  TMS.  suppose  that  a  hypothetical  office 
scheduling  program  considers  holding  a  meeting  on  Wednesday  To  do  this,  the  program 
assumes  that  the  meeting  is  on  Wednesday  The  inference  system  of  the  program  Includes  a 
rule  which  draws  the  conclusion  that  due  to  regular  commitments,  any  meeting  on 
Wednesday  must  occur  at  100  PM  However,  the  fragment  of  the  schedule  for  the  week 
constructed  so  far  has  some  activity  scheduled  for  that  time  already,  and  so  another  rule 
concludes  the  meeting  cannot  be  on  Wednesday  We  write  these  nodes  and  rule-constructed 
justifications  as  follows 


Node 

Statement 

J  ustiflcation 

Comnrnf 

N-l 

DAY  IMS  .  WEDNESDAY 

(SL  O  IN-21 1 

on  assumption 

N-2 

OAYim  0  UEDNESOAY 

no  Justification  yet 

N-3 

TINE  (HI  -  13:90 

ISL  (R-37  N-l)  (1) 

The  above  notation  for  rhe  justifications  Indicates  that  they  belong  to  the  class  of 
support-fist  (SL)  justifications  Each  of  these  justifications  consists  of  two  lists  of  nodes  A 
SL  justification  is  a  valid  reason  for  belief  if  and  only  If  each  of  the  nodes  in  the  first  list  is 
believed  and  each  of  the  nodes  In  the  second  list  is  not  believed  In  the  example,  if  the  two 
justifications  listed  above  are  the  only  existing  justifications,  then  N-2  is  not  a  current  belief 
since  it  has  no  justifications  at  all  N-l  Is  believed  since  the  justification  for  N-l  specifies 
that  this  node  depends  on  the  lack  of  belief  In  N-2.  The  justification  for  N-3  shows  that 
N-3  depends  on  a  (presumably  believed)  node  R-37.  In  this  case.  R-37  represents  a  rule 
acting  on  (the  statement  represented  by)  N-l. 

Subsequently  another  rule  (represented  by  a  node  R-9)  acts  on  beliefs  about  the 
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clay  and  time  of  some  other  engagement  trepiesented  by  the  nodes  N-7  and  N-8)  to  reject 
the  assumption  N-  1 

N-2  0AY(m  -  UFONESOAY  (SL  (R-9N-7N-8I  (M 

To  accomodate  this  new  justification,  the  TMS  will  revise  the  current  set  of  beliefs  so  that 
N  2  is  believed,  and  N  !  and  N-3  are  not  believed  It  does  this  by  tracing  "upwards"  from 
the  node  to  be  changed.  N -2.  to  see  that  N  I  and  N-3  ultimately  depend  on  N-Z  It  then 
carefully  examines  the  justifications  of  each  of  these  nodes  to  see  that  N-2's  justification  Is 
valid  (so  that  N-2  is  in)  Fiom  this  it  follows  that  N-l‘s  justification  is  invalid  (so  N-l  Is 
ruf).  and  hence  that  N-3's  justification  is  Invalid  (so  N-3  is  our) 

2  Representation  of  Reasons  for  Reliefs 

21  Stales  of  Relief 

A  node  may  have  several  justifications,  each  justification  representing  a  different  reason  for 
believing  the  node  These  several  justifications  comprise  the  node’s  Jutli/uation-itl  The 
node  is  believed  if  and  only  if  at  least  one  of  its  justifications  Is  valid  We  described  the 
conditions  lor  validity  of  SI.  justifications  above  and  shortly  will  introduce  and  explain  the 
other  tvjw  of  justification  used  in  the  TMS  We  say  that  a  node  which  has  at  least  one 
valid  justification  is  in  (the  current  set  of  beliefs),  and  that  a  node  with  no  valid 
justifications  is  pur  (of  the  current  set  of  beliefs)  We  will  alternatively  say  that  each  node 
has  a  rupppr/  rfafui  of  either  in  or  our  The  distinction  between  in  and  out  Is  not  that 
between  due  and  faht  The  former  classification  refers  to  current  possession  of  valid 
reasons  for  belief  Tint  and  faht.  on  the  other  hand,  classify  statements  according  to  truth 
value  indejrendrnt  of  any  irasons  for  belief 

In  the  TMS.  carh  jsotential  belief  to  be  used  as  a  hyjrothests  or  conclusion  of  an 
argument  must  be  given  its  own  distinct  nod,’  When  uncertainty  about  some  statement  (eg. 
P)  exists,  one  must  (eventually)  provide  nodes  for  both  the  statement  and  its  negation 
Either  of  these  nodes  ran  have  or  lack  well-founded  arguments,  leading  to  a  four  element 
belief  set  (similar  to  the  belief  set  urged  by  Belnap  (21)  of  neither  P  nor  -P  believed,  exactly 
one  believed,  or  both  believed 

The  literature  contains  many  proposals  for  using  three-element  belief  sets  of  ttut, 
faht.  and  unkvewn  With  no  notion  of  justified  belief,  these  proposals  have  some  attraction 
I  urge,  however,  that  systems  based  on  a  notion  of  justified  belief  should  forego 
three  valued  logics  in  favot  of  the  four-valued  system  presented  here,  or  risk  a  confusion  of 
truth  with  justified  behef  Users  of  justification  based  three  valued  systems  can  avoid 
problems  if  they  take  care  to  interpret  their  systems  tn  terms  of  justifications  rather  than 
truth  values,  hut  the  danger  of  confusion  jrems  greater  when  the  belief  set  hides  this 
distinction  One  might  argue  that  holding  contradictory  beliefs  Is  just  a  transient  situation, 
and  that  any  stable  situation  uses  only  three  belief  states  Irut  -  only  P  believed,  fal it  -  only 
^P  believed,  and  unknown  •  neither  believed  Rut  the  need  for  the  f  -element  system 


cannot  be  dismissed  so  easily  Since  we  male  the  proem  of  revising  beliefi  our  main 
Intemf.  we  concern  ourselves  with  those  processes  which  operate  during  the  transient 
situation  For  hard  problems  and  tough  decisions,  these  'transient'  states  can  b<*  quite 
long  lived 

M  Justifications 

Justifications,  as  recorded  in  the  TMS.  have  two  parts  the  external  form  of  the  justification 
with  significance  to  the  problem  solver,  and  the  internal  form  of  significance  to  the  TMS 
For  example,  a  justification  might  have  the  external  form  (Hodus-Ponen*  A  AuBI  and 
have  the  Internal  form  (SI  IN- 1  N-2  N-3>  ID.  supposing  that  N-l  represents  the  rule 
Modus-Ponona.  N-2  represents  A,  and  N-3  represents  A 30  The  TMS  never  uses  or 
examines  the  external  forms  of  justifications,  but  merely  records  them  for  use  by  the 
problem  solver  In  constructing  externally  meaningful  explanations  Henceforth,  we  will 
Ignore  these  external  forms  of  justifications 

Although  natural  arguments  may  use  a  wealth  of  types  of  argument  steps  or 
Justifications,  the  TMS  forces  one  to  fit  all  these  into  a  common  mold  The  TMS  employs 
only  two  (internal)  forms  for  justifications,  called  iupport-hst  (SL)  and  conditional- proof  (CP) 
justifications  These  are  inspired  by  the  typical  forms  of  arguments  in  natural  deduction 
inference  systems,  which  either  add  or  subtract  dejjendencles  from  the  support  of  a  proof 
line  A  proof  In  such  a  system  might  run  as  follows 


Lint 

Statement 

J  unification 

Dependencies 

1. 

A30 

Prent  »e 

111 

2. 

BdC 

Pre»i se 

121 

3. 

A 

Hypothec i 9 

131 

4. 

B 

MP  1.3 

11.31 

5. 

C 

HP  2.4 

11.2.31 

6. 

A* 

Oi  scisarQ*  3.S 

11.21 

Each  step  of  the  proof  has  a  line  number,  a  statement,  a  justification,  and  a  set  of  line 
numbers  on  which  the  statement  depends  Premises  and  hypotheses  depend  on  themselves, 
and  other  lines  depend  on  the  set  of  premises  and  hypotheses  derived  from  their 
justifications  The  above  proof  proves  AdC  from  the  premises  Ad0  and  BnC  by 
hypothesirtng  A  and  concluding  C  via  two  applications  of  Modus  Ponens  The  proof  of  AnC 
ends  by  discharging  the  assumption  A,  which  frees  the  conclusion  of  dependence  on  the 
hypothesis  but  leaves  Its  dependence  on  the  premises 

This  example  displays  justifications  which  sum  the  dependencies  of  some  of  the 
referenced  lines  (as  In  line  4)  and  subtract  the  dependencies  of  some  lines  from  those  of 
other  lines  (as  In  line  6)  The  two  types  of  ju$tif:cations  used  In  the  TMS  account  for  these 
effects  on  dependencies  A  support  list  justification  says  that  the  justified  node  depends  on 
each  node  In  a  set  of  other  nodes,  and  in  effect  sums  the  dependencies  of  the  referenced 
nodes  A  conditional  proof  justification  says  that  the  node  It  justifies  depends  on  the 


validity  o(  a  certain  hypothetical  argument  As  in  the  example  above,  it  subtract*  the 
dependencies  of  some  nodes  (the  hypotheses  of  the  hypothetical  argument)  from  the 
dependencies  of  others  (the  conclusion  of  the  hypothetical  argument)  Thu*  we  might 
rewrite  the  example  in  terms  of  TMS  justifications  as  follows  (here  ignoring  the  difference 
between  premises  and  hypotheses,  and  ignoring  the  inference  rule  MP) 


N-l 

AdO 

(SL  fl  01 

Promise 

N-2 

BdC 

(SL  0  0) 

Premise 

N-3 

A 

(SL  0  0) 

Premise 

N-4 

B 

(SL  (N-l  N-3)  0) 

MP 

N-S 

C 

(SL  (N-2N-4I  (II 

MP 

N-6 

A^C 

(CP  N-S  (N-3)  01 

Discharge 

CP-justifications.  which  will  be  explained  in  greater  detail  below,  differ  from  ordinary 
hypothetical  arguments  in  that  they  use  two  lists  of  nodes  as  hypotheses,  the  Inhypothese* 
and  the  euthypotheses  In  the  above  justification  for  N  6,  the  list  of  inhypothese*  contain* 
just  N  3.  and  the  list  of  oufhypotheset  is  empty  This  difference  results  from  our  use  of 
non  monotonic  justifications,  in  which  arguments  for  nodes  can  be  based  both  on  in  and  out 
nodes 

2  3  Support  list  justifications 

To  repeat  the  definition  scattered  throughout  the  previous  discussion  the  support-list 
justification  has  the  form 

tSL  <lnl  i s t >  'full  ist»), 

and  is  valid  if  and  only  if  each  node  in  its  inlist  is  in,  and  each  node  in  it*  ou/llst  I*  cut 
The  SL.  justification  form  can  represent  several  types  of  deductions  With  empty  Inllit  and 
empty  ouMist.  we  say  the  justification  fotms  a  premise  justification  A  premise  justification  it 
always  valid,  and  so  the  node  it  justifies  will  always  be  in  SL  justifications  with  nonempty 
fnlists  and  empty  euflists  represent  normal  deductions  Lach  such  justification  represent*  a 
monotonic  argument  for  the  node  it  justifies  ftom  the  nodes  of  its  inlist  We  define 
assumptions  to  be  nodes  whose  supporting  justification  has  a  nonempty  ouMtst  These 
assumption  justifications  can  be  intetprcrcd  by  viewing  the  nodes  of  the  inlist  as  comprising 
the  reasons  for  wanting  to  assume  the  justified  node,  the  nodes  of  the  out  list  represent  the 
specific  criteria  authormng  this  assumption  f  or  example,  the  reason  for  wanting  to  assume 
“The  weather  will  be  nice'  might  be  "Be  optimistic  about  the  weather*,  and  the  assumption 
might  be  authorired  by  having  no  reason  ro  believe  “The  weather  will  be  bad."  We 
occasionally  Interpret  the  nodes  of  the  rurlist  as  "dentals'  of  the  justified  node,  beliefs  which 
Imply  the  negation  of  the  belief  represented  by  the  justified  node. 


2-4  Terminology  of  Dependency  Relationships 

I  muu  pause  to  present  some  terminology  before  explaining  CP-justifications  The 
definitions  of  dependency  relationships  introduced  in  this  section  are  numerous,  and  the 
reader  should  consult  Figures  I,  2.  and  5  for  examples  of  the  definitions 

As  mentioned  prevtcwily.  the  TMS  singles  out  one  justification,  called  the 
supporting  justification,  in  the  justification  set  of  each  In  node  to  form  part  of  the 
non-circular  argument  for  the  node  For  reasons  explained  shortly,  all  nodes  have  only 
SL  justification!  as  their  supjsorting  justifications,  never  CP-justifications  The  set  of 
supporting  nodts  of  a  node  is  the  set  of  nodes  which  the  TMS  used  to  determine  the 
support-status  of  the  node  For  in  nodes,  the  sujiporting-nodes  are  just  the  nodes  listed  in 
the  inlist  and  miflist  of  its  supporting  justification,  and  in  this  case  we  also  call  the 
supporting  nodes  the  anrnriifnts  of  the  node  For  the  supporting  nodes  of  out  nodes,  the 
TMS  picks  one  node  from  each  justification  in  the  justification-set  From  SL-justifications. 
It  picks  either  an  our  node  from  the  mlist  or  an  in  node  from  the  euilist  From 
CP-justtficaltons,  it  picks  either  an  out  node  from  the  (nhypotheses  or  consequent  or  an  in 
from  the  euihypotheses  We  define  the  supporting-nodes  of  out  nodes  In  this  way  so  that 
the  support  status  of  the  node  in  question  cannot  change  without  either  a  change  in  the 
support  status  of  one  of  the  supporting -nodes,  or  without  the  addition  of  a  new  valid 
justification  We  say  that  an  euf  node  has  no  antecedents  The  TMS  keeps  the 
supporting  nodes  of  each  node  as  part  of  the  node  data-structure.  and  computes  the 
antecedents  of  the  node  from  this  list 

The  set  of  foundations  of  a  node  is  the  transitive  closure  of  the  antecedents  of  the 
node,  that  is.  the  antecedents  of  the  node,  their  antecedents,  and  so  on  This  set  is  the  set  of 
nodes  involved  in  ihe  well  founded  argument  for  belief  in  the  node  The  set  of  ancestors  of 
a  node,  analogously,  is  the  transitive  closure  of  the  supporting -nodes  of  the  node,  that  is.  the 
supporting  nodes  of  the  node,  thetr  supjsorting  nodes,  and  so  on  This  set  Is  Ihe  set  of 
nodes  which  might  gtossihly  affect  the  support  status  of  the  node  The  ancestors  of  a  node 
may  include  Ihe  node  itself,  for  the  closure  of  the  supporting  nodes  relation  need  not  be 
well-founded  The  TMS  computes  these  dependency  relationships  from  the 
supporting  nodes  and  antecedents  of  nodes 

In  the  other  direction,  the  set  of  consequences  of  a  node  is  the  set  of  all  nodes 
which  mention  ihe  node  in  one  of  Ihe  justifications  in  their  justification  set  The 
affected  consequences  of  a  node  are  just  those  consequences  of  the  node  which  contain  the 
node  tn  thetr  set  of  suppot ting  nodes  The  belieoedcontequences  of  a  node  are  just  those  in 
consequences  of  the  node  which  contain  the  node  in  their  set  of  antecedents  The  TMS 
keeps  the  consequences  of  each  node  as  part  of  the  node  data-structure,  and  computes  the 
affected-  and  believed  consequences  from  the  con  sequences 

The  set  of  rr/xrcujjlom  of  a  node  is  the  transitive  closure  of  the 
affected  consequences  of  the  node,  that  is.  the  affected-consequences  of  Ihe  node,  their 
affected  consequences,  and  so  on  The  set  of  belleoecfrepercussiont  of  a  node  is  the 
transitive  closure  of  the  believed -consequences  of  ihe  node,  that  is,  the  believed -consequences 
of  the  node,  then  believed  consequences,  and  so  on  The  TMS  computes  all  these 
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relationships  fiom  the  consequences  of  the  node 

In  all  of  the  following.  I  visualize  the  lines  of  support  for  nodes  as  directed 
upwards,  so  that  I  look  up  to  see  repercussions,  and  down  to  see  foundations  I  say  that  one 
node  is  of  tower  level  than  another  if  its  believed  repercussions  include  the  other  node 

2  5  Conditional  proof  Justifications 

With  this  terminology,  we  can  now  begin  10  explain  conditional  proof  justifications  The 
exact  meaning  of  these  justifications  in  the  TMS  is  complex  and  difficult  to  describe,  so  the 
reader  may  find  this  section  hard  going,  and  may  benefit  by  referring  back  to  it  white 
reading  Sections  3  3.  •♦.  and  S  CP  justifications  take  the  form 

(CP  'consequent >  <inrsypotheses>  <pnfhypotPeses>) 

A  CP  justification  is  valid  if  the  consequent  node  is  in  whenever  (a)  each  node  of  the 
rnhyjrotheses  is  rn  and  (b)  each  node  of  the  ru/hypotheses  is  rut  Except  in  a  few  esoteric 
uses  described  latet.  the  set  of  eufhypotheses  is  empty,  so  normally  a  node  justified  with  a 
CP  justification  represents  (he  implication  whose  antecedents  are  the  inhypotheses  and 
whose  consequent  is  the  consequent  of  the  CP  justification  Standard  conditional  proofs  in 
natural  deduction  systems  typically  specify  a  single  set  of  hypotheses,  which  corresponds  (o 
the  inhypotheses  of  a  CP  justification  In  the  present  case,  the  set  of  hypotheses  must  be 
divided  into  two  disjoint  subsets,  since  nodes  may  be  derived  both  from  some  nodes  being 
in  and  other  nodes  being  put  Some  deduction  systems  also  employ  multipie-consequent 
conditional  proofs  We  fotego  these  for  reasons  of  implementation  efficiency 

The  TMS  handles  CP  justifications  in  special  ways  It  can  easily  determine  the 
validity  of  a  CP  justification  only  when  the  justification's  consequent  and  inhypotheses  are 
in  and  the  pu, 'hypotheses  ate  rut.  since  determining  (he  justification's  validity  with  other 
support  statuses  foi  these  nodes  may  require  switching  the  support  statuses  of  the  hypothesis 
nodes  and  their  repercussions  to  set  up  the  hypothetical  situation  in  which  the  validity  of 
the  conditional  proof  can  be  evaluated  This  may  may  require  truth  maintenance 
processing,  which  in  turn  may  require  validity  checking  of  further  CP-justificatlons,  and  so 
the  whole  process  becomes  extremely  complex  Instead  of  attempting  such  a  detailed 
analysis  (for  which  I  know  no  algorithms),  the  T  MS  uses  the  opportunistic  and  approximate 
Strategy  of  computing  M  justifications  currently  equivalent  to  CP  justifications  Ai  the  time 
of  their  creation,  these  new  SI  justifications  are  equivalent  to  the  CP-justtfications  in  terms 
of  the  dependencies  they  specify,  and  are  easily  checked  for  validity  Whenever  the  TMS 
finds  a  (  P  justification  valid  it  com  pules  an  equivaleni  SI  justification  by  analyzing  the 
well  founded  argument  for  the  consequent  node  of  the  CP  justiftcation  to  find  those  nodes 
which  aie  not  themselves  suppoited  by  any  of  the  inhypotheses  or  curhypotheses  but  which 
diiectly  rntri  into  the  argument  for  the  consequent  node  aiong  with  the  hyjKXheset. 
Precisely,  the  TMS  finds  all  nodes  N  in  the  foundations  of  the  consequent  such  that  N  It 
not  one  of  the  hypotheses  or  one  of  their  re|iercus«ions.  and  N  is  either  an  antecedent  of  the 
consequent  or  an  antecedent  of  some  other  node  in  the  repercussions  of  the  hyjsotheses  The 
in  nodes  in  this  set  form  the  mlist  of  the  equivalent  SI.  justification,  and  the  out  nodes  of 
the  set  form  the  oirflist  of  the  equivalent  SL  justification  The  TMS  'ches  the  list  of 
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SL  justifications  computed  in  this  way  to  their  parent  CP-justtflcattons,  and  always  prefers 
to  use  these  SL-justifications  in  Its  processing  The  TMS  checks  the  derived 
SL-jostifications  first  in  determining  the  support-status  of  a  node,  and  uses  them  in 
explanations  It  uses  only  SL-justificatlons  (derived  or  otherwise)  as 
supporting-justifications  of  nodes 

2.6  Other  Types  of  Justifications 

My  experience  with  the  TMS  indicates  that  yet  more  forms  of  justifications  would  be  useful. 
A  gtntrol  ferm  (GF)  justification  merges  the  above  two  forms  into  one  In  which  the  nodes 
in  an  Inlist  and  an  eurlist  are  added  to  the  result  of  a  conditional-proof  We  might  notate 
this  as 


(GF  </nlist>  cuflist*  consequent*  ^hypotheses*  «ou/hypo theses* I 
I  also  suggest  a  rummarirahon  (SUM)  justification  form. 

(SUM  consequent >  <lnhypotheses>  <oulbypotheses>l. 
which  abbreviates 

(GF  cinhypo  these  sxew  (hypo  these  exconsequent  xin  hypo  thesesxeuf  hypo  theses*  I . 

This  form  adds  the  hypotheses  of  a  conditional -proof  back  into  the  result  of  the 
conditional  proof,  thus  summaruing  the  argument  for  the  consequent  by  excising  the 
intermediate  part  of  the  argument  Section  5  explains  this  technique  in  detail  I  use 
SUM  justifications  there  foi  expository  convenience,  although  I  have  not  implemented  them 
in  the  TMS 

3  Truth  Maintenance  Mechanisms 
3.1  Circular  Arguments 

Suppose  a  program  manipulates  three  nodes  as  follows 
F  I.  UXY)  U  ...  omitted 

o  (-  x  i)  isl  iy>  in 

H  (.  Y  31  (SL  IK)  cn. 

(We  sometimes  leave  statements  and  justifications  of  nodes  unspecified  when  they  are  not 
directly  relevant  to  the  presentation  We  assume  that  all  such  omitted  justifications  are 
valid )  If  /  is  in  and  K  is  out.  then  the  TMS  will  make  F  and  G  in,  and  H  out.  If  the 
program  then  justifies  H  with 
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(SI  IF  G)  (I), 

the  TMS  will  bring  H  in  Suppose  now  that  the  TMS  makes  )  puf  and  K  In,  leading  to  C 
becoming  out  and  H  remaining  in  The  program  might  then  justify  C  with 

(SI  IF  H)  in 

If  the  TMS  now  takes  K  out.  the  original  justification  supporting  belief  in  H  becomes 
invalid,  leading  the  TMS  to  reassess  the  grounds  for  belief  in  H  If  It  makes  Its  decision  to 
believe  a  node  on  the  basis  of  a  simple  evaluation  of  each  of  the  justifications  of  the  node, 
then  it  will  leave  both  C  and  H  In.  since  the  two  most  recently  added  justifications  form 
circular  arguments  for  0  and  H  in  terms  of  each  other 

These  circular  arguments  supjrorting  belief  in  nodes  motivate  the  use  of 
well  founded  supporting  justifications,  since  nodes  imprudently  believed  on  tenuous  circular 
bases  can  lead  to  ill  considered  actions,  wasted ‘data  base  searches,  and  Illusory 
inconsistencies  which  might  never  have  occurred  without  the  misleading,  circularly 
supported  beliefs  In  view  of  this  problem,  the  algorithms  of  the  TMS  must  ensure  that  it 
believes  no  node  for  circular  reasons 

Ptnported  aignments  for  nodes  can  contain  essentially  three  different  kinds  of 
circularities  The  fust  and  mon  common  type  of  circularity  involves  only  nodes  which  can 
be  taken  to  be  out  consistently  wuh  their  justifications  Such  circularities  arise  routinely 
through  equivalent  or  conditionally  equivalent  beliefs  and  mutually  constraining  beliefs. 
The  above  algebra  example  falls  into  this  class  of  circularity 

The  second  type  of  circularity  includes  at  least  one  node  which  must  be  In. 
Consider,  for  example 

F  TO  BF  (SL  (I  (CM 

C.  -TO-Bt  ISL  (I  (Fll 

In  the  absence  of  other  justifications,  these  justifications  force  the  TMS  either  to  make  F  In 
and  C  out.  or  6  in  and  F  out  This  type  of  circularity  can  arise  in  certain  types  of  sets  of 
alternatives 

In  unsatisfiable  circularities,  the  third  type,  no  assignment  of  In  or  out  to  nodes  is 
consistent  with  their  justifications  Consider 

F  ...  ISL  I)  (FI) 

With  no  other  justifications  for  F.  the  TMS  must  make  F  In  If  and  only  If  it  makes  F  euf, 
an  impossible  task  Unsatisfiable  circularities  sometimes  indicate  real  inconsistencies  in  the 
beliefs  of  the  program  using  the  truth  maintenance  system,  and  can  be  manifest,  for 
example,  when  prolonged  backtracking  rules  out  all  possibilities  The  current  version  of  the 
TMS  does  not  handle  unsatisfiable  circularities  (it  goes  Into  a  loop),  as  I  removed  the 
occasionally  couly  check  for  the  presence  of  such  circularities  to  increase  the  normal-case 
efficiency  of  the  program  A  robust  .mplementalion  would  reinstate  this  check  Step  S  In 
Section  32  discusses  this  problem  in  more  detail 
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3.2  The  Truth  Maintenance  Proem 

The  truth  maintenance  process  makes  any  necessary  revisions  in  the  current  set  of  beliefs 
when  the  user  adds  to  or  subtracts  ftom  the  justification-set  of  a  node.  Retracting 
justifications  presents  no  important  problems  beyond  those  of  adding  justifications,  so  we 
ignore  retractions  to  simplify  the  discussion  We  first  outline  the  procedure,  and  then 
present  It  in  greater  detail  The  details  will  not  be  crucial  in  the  following,  so  the  casual 
reader  should  read  the  oveiview  and  then  skip  to  Section  1 

In  outline,  the  truth  maintenance  process  starts  when  a  new  justification  is  added 
to  a  node  Only  minor  bookkeeping  is  required  if  the  new  justification  is  invalid,  or  if  it  Is 
valid  but  the  node  is  already  in  If  the  justification  is  valid  and  the  node  is  our.  then  the 
node  and  its  repercussions  must  be  updated  The  TMS  makes  a  list  containing  the  node 
and  its  repercussions,  and  marks  each  of  these  nodes  to  indicate  that  they  have  not  been 
given  well  founded  support  The  TMS  then  examines  the  justifications  of  these  nodes  to 
see  If  any  are  valid  purely  on  the  basis  of  unmarked  nodes,  that  is.  purely  on  the  basis  of 
nodes  which  do  have  well  founded  support  If  it  finds  any.  these  nodes  are  brought  In  (or 
out  if  all  their  justifications  are  invalid  purely  on  the  basis  of  well  founded  nodes)  Then 
the  marked  consequences  of  the  nodes  are  examined  to  see  if  they  too  can  now  be  given 
wel l-fotmdrd  support  Sometimes,  after  all  of  the  marked  nodes  have  been  examined  in  this 
way.  well  founded  support  statuses  will  have  been  found  for  all  nodes  Sometimes,  however, 
some  nodes  will  remain  marked  due  to  circularities  The  TMS  then  initiates  a 
constraint  relaxation  process  which  assigns  support  statuses  to  the  remaining  nodes  Finally, 
after  all  this,  the  TMS  checks  for  contradictions  and  CP  justifications,  performs 
dependency  directed  backtracking  and  CP  justification  processing  If  necessary,  and  then 
signals  the  user  program  of  the  changes  in  support-statuses  of  the  nodes  involved  in  truth 
maintenance 

In  detail,  the  steps  of  the  algorithm  are  at  follows  We  enclose  comments  In 
bracket  asterisk  pairs  (Fg  (  This  is  a  comment  o)) 

Step  I  Adding  a  new  justification  Add  the  new  justification  to  the  node's  justification  set 
and  add  the  node  to  the  set  of  consequences  of  each  of  the  nodes  mentioned  in  the 
justification  If  the  justification  is  a  CP  justification,  add  the  node  to  the 
CP  con  sequent  list  of  the  consequent  of  the  CP-justificatlon.  for  use  in  Step  6  If  the 
node  is  In.  we  are  done  If  the  node  is  out.  check  the  justification  for  validity  If 
Invalid,  add  to  the  supporting  nodes  either  an  oat  node  from  the  Inlist.  or  an  In  node 
from  the  ouMist  If  valid,  proceed  to  Step  2 

Step  2  Updating  beliefs  required  Check  the  affected  consequences  of  the  node  If  there 
ate  none,  change  the  support  status  to  in.  and  make  the  supporting-nodes  the  sum  of 
the  inlist  and  nirlisi,  then  stop  Othciwise.  make  a  list  L  containing  the  node  and  Its 
repercussions,  terord  the  supj>ort  status  of  each  of  these  nodes,  and  proceed  to  Step  3. 
(  We  must  collect  all  the  irpricusttons  of  the  node  to  avoid  constructing  circular 
arguments  which  use  tepetcnssions  of  a  node  in  Its  supposedly  well-founded  supporting 
aigumeni  0 


Step  3  Marking  iht  nodti  Mark  rath  nodr  in  L  with  a  support  status  of  nit.  and  proceed 
to  Step  4  (*  Nodes  can  have  a  support  status  of  nit  only  during  tiuth  maintenance. 
This  mark  distinguishes  those  nodrs  with  well  founded  support  from  those  for  which 
well  founded  support  has  not  been  determined  cj 
Step  4  Evaluating  Me  nodti'  fuiti/iianom  For  each  node  in  L.  execute  the  following 
subprocedure  When  all  are  done,  proceed  to  Step  5 

Step  4a  Evaluating  Me  j unification  srt  If  the  node  is  either  in  or  nut.  do  nothing. 
Otherwise,  keep  picking  justifications  from  the  justification  set,  first  the 
SL  justifications  and  then  the  CP  justifications,  checking  them  for  well-founded 
validity  or  invalidity  (to  be  defined  shortly)  until  either  a  valid  one  Is  found  or  the 
justification  set  is  exhausted  l'  The  TMS  tries  justifications  in  chronological 
order,  oldest  first  t-J  if  a  valid  justification  is  found,  then  (I)  install  It  as  the 
supporting  justification  (first  converting  it  to  SL  form  if  it  is  a  CP- justification),  (2) 
Install  the  supporting  nodes  as  in  Step  2.  (3)  mark  ihe  node  In.  and  (4)  recursively 
perform  Step  4a  for  all  consequences  of  the  node  which  have  a  support  status  of 
nil  If  only  well  founded  invalid  justifications  are  found,  mark  the  node  out.  Install 
Its  supporting  nodes  as  in  Step  I,  and  recursively  perform  Step  4a  for  all 
nil-marked  consequences  of  the  node  Otherwise,  the  processing  of  the  node  is 
temporarily  deferred,  the  subprocedure  is  finished  [•  An  SL-justlficatlon  Is 

writ  foundtd  valid  if  each  node  in  ihe  tnlist  is  in  and  each  node  of  the  oufltst  Is  out. 
It  Is  tutll  foundtii  invalid  if  some  node  of  the  enlist  is  out  or  some  node  of  the  outllst 
is  in  C.P  justifications  are  well  founded  valid  if  all  Inhypotheses  are  In,  all 
pufhypocheses  are  out.  and  the  consequent  is  in.  they  are  well  founded  invalid  If  all 
inhypotheses  are  in.  all  euthypotheses  are  out.  and  the  consequent  Is  out  e) 
l«  This  step  may  find  well  founded  supporting  justifications  for  some  nodes  In  L.  but 
may  leave  the  support  status  of  some  nodes  undetermined  due  to  circularities  In 
potential  arguments  These  leftover  nodes  are  handled  by  Step  b  below  If  It  were  not 
for  CP  justifications.  Step  4  could  be  dispensed  with  entirely,  as  Seep  5  effectively 
subsumes  it  However,  we  include  Step  4  both  lo  handle  CP-justifications  and  to 
Improve  (we  hope)  the  efficiency  of  ihe  algorithm  by  getting  the  solidly  supported 
nodes  out  of  the  way  first  «) 

Step  5  Rrlating  circularttiti  For  each  node  in  L,  execute  the  following  subprocedure. 
On  completion,  proceed  to  Step  6 

Step  5a  Evaluating  tkt  juiti/ication  jrt  If  the  node  Is  either  in  or  out,  do  nothing. 
Otherwise,  continue  to  select  justifications  from  the  SL-justlficattons  (ignoring  the 
CP  justifications)  and  to  check  them  for  not -well -founded  validity  or  invalidity  I* 
which  assumes  that  all  nodes  currently  marked  nil  will  eventually  be  marked  out,  as 
explained  shortly  <•■)  until  either  a  valid  justification  Is  found  or  the  justificatton-wt 
is  exhausted  If  all  Justifications  are  invalid,  mark  the  node  out.  Install  Its 
supporting  nodes  as  in  Step  I.  and  recursively  perform  Step  5a  for  all  nt/roarked 
consequences  of  the  node  If  a  valid  justification  is  found,  tb-n  a  special  check 
must  be  made  to  see  if  the  node  already  has  affected-consequ  .ices  If  the  node 
does  have  affected  consequences,  then  all  of  them,  and  the  node  as  well,  mutt  be 
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re  marked  with  nil  and  re  examined  by  the  loop  of  Step  5  fa  We  do  this  because 
the  procedure  may  have  previously  determined  the  support-status  of  some  other 
node  on  the  assumption  that  this  node  was  out  0  If  there  are  no 
affected-consequences.  then  install  the  valid  justification  as  the 
supporting  justification,  install  the  supporting -nodes  as  in  Step  2,  mark  the  node  In, 
and  then  recursively  jserform  Step  Sa  for  all  consequences  of  the  node  which  have  a 
support -status  of  nil  fa  All  justifications  will  be  either  not-well-founded  valid  or 
invalid,  there  is  no  third  case  An  SL-justificatlon  is  not-well-founded  valid  if  each 
node  in  the  /nlist  is  in  and  no  node  of  the  ourlist  Is  In.  otherwise,  it  is 
not-well-founded  invalid  This  evaluation  of  nodes  assumes  that  a  support -status 
of  nil  is  the  same  as  out.  le  that  all  currently  unassigned  nodes  will  eventually  be 
marked  out  o) 

fa  If  Step  8  terminates,  it  finds  well  founded  support-statuses  for  all  nodes  in  L  It  wilt 
not  terminate  if  unsatisfiable  circularities  exist  These  circularities  can  be  detected  by 
checking  to  see  if  a  node  is  its  own  ancestor  after  finding  a  not -well  founded  valid 
justification  for  it  in  Step  5a  If  the  node  Is  its  own  ancestor,  an  unsatisfiable  circularity 
exists  in  which  the  argument  for  belief  in  the  node  depends  on  lack  of  belief  in  the 
node  Unfortunately,  this  sort  of  non-termination  can  also  occur  with  a  satisfiable  set  of 
nodes  and  justifications  which  requires  making  changes  to  nodes  not  in  the  list  L  to 
find  this  satisfiable  assignment  of  support-statuses  For  example,  if  F  is  in  but  not  in  L, 
and  If  G  has  only  the  justification  (SL  ( FI  (GH  and  Is  in  L,  then  the  procedure  will 
not  he  able  to  assign  a  well  founded  support-status  to  G  without  going  outside  L  to 
change  the  support  status  of  F  In  consequence.  If  truth  maintenance  is  done  ptoperly 
It  must  be  non  incremental  in  such  cases 

This  relaxation  procedure  finds  one  assignment  of  support-statuses  to  nodes,  but 
there  may  be  several  such  assignments  possible  A  more  sophisticated  system  would 
incorjrorate  some  way  in  which  to  choose  between  these  alternatives,  since  guidance  In 
what  the  program  bebeves  will  typically  produce  guidance  in  what  the  program  does 
Some  versions  of  the  TMS  (eg  (Hi)  incorporated  rudimentary  analysis  facilities,  but 
the  current  version  lacks  any  such  ability  It  appears  that  this  relaxation  step  must  be 
fairly  blind  in  choosing  what  revision  to  make  Methods  for  choosing  between 
alternate  revisions  must  have  some  idea  of  what  all  the  alternate  revisions  are.  and 
these  are  very  hard  to  determine  accurately  One  can  approximate  the  set  of  alternate 
revisions  by  revisions  including  some  particular  belief,  but  aP?r  several  such 
approximations  this  adds  up  to  just  trying  some  partial  revision  and  seeing  if  it  works 
out  el 

Step  6  c treking  for  C P-fiistificattons  and  contradictions  Call  each  of  the  following 
subprocedures  for  each  of  the  nodes  in  L.  and  then  proceed  to  Step  7  (  This  step 

attempts  tc  derive  new  SL  justifications  from  CP-justifications.  and  to  resolve  any 
inconsistencies  aj>|>earing  in  the  new  set  of  beliefs  Since  Step  5  leaves  all  nodes  In  L 
eithei  in  or  out.  it  may  now  be  possible  to  evaluate  some  CP  justifications  which  were 
previously  unevaluable.  and  to  tesolve  newly  apparent  contradictions  o) 

Step  6a  Check  for  CP  /unifications  Do  nothing  if  the  node  Is  out  or  has  an  empty 


CP  consequent  list  Othetwise,  for  each  node  in  the  CP -consequent-list,  check  its 
CP  justifications  for  validity,  and  if  any  are  valid,  derive  their  currently  equivalent 
St -justifications  and  justify  (he  node  with  (he  resulting  justification  If  this 
justification  is  new  and  causes  truth  maintenance  (Steps  I  through  5).  start  Step  6 
over,  otherwise  return 

Step  6h  Check  /or  contiadutions  Ignore  the  node  unless  it  is  in  and  is  marked  as  a 
contradiction,  in  which  case  call  the  dependency-directed  backtracking  system  on 
the  node  If  truth  maintenance  (Steps  I  through  5)  occurs  during  backtracking, 
start  Step  6  over,  otherwise  return 

[o  This  step  halts  only  when  no  new  SLjustificatiom  can  be  computed  from 
CP-justifications,  and  no  contradictions  exist  or  can  be  resolved  o) 

Step  7  Signalling  changes  Compare  the  current  support-status  of  each  node  in  L  with  the 
initial  status  recorded  in  Step  2.  and  call  the  user  supplied  signal-recalling  f unctions 
and  jig-nnf  forgetting  functions  to  signal  changes  from  out  to  in  and  from  in  to  out. 
respectively  (  The  user  must  supply  two  global  functions  which,  if  not  overridden  by 
a  local  function  that  the  user  might  attach  to  the  changed  node,  are  called  with  the 
changed  node  as  the  argument  However,  if  the  user  has  attached  local  function  to  the 
changed  node,  the  TMS  will  call  that  function  Instead  o) 

End  of  the  Hull  maintenance  procedure 

For  more  detail,  I  recommend  the  chapter  on  data  dependencies  in  HI  which  presents  a 
simplified  LISP  implementation  of  a  TMS-like  program  along  with  a  proof  of  Its 
correctness  McAllester  [V°  presents  an  alternative  implementation  of  a  truth  maintenance 
system  with  a  cleaner  organization  than  the  above  Doyle  (IS)  presents  a  program  listing  of 
one  version  of  the  TMS  in  an  appendix 

5  5  Analyzing  Conditional-Proofs 

The  Find  Independent  Support  (FIS)  procedure  computes  SL-justificatlons  from  valid 
C.P  justifications  by  finding  those  nodes  supporting  the  consequent  which  do  not  depend  on 
the  hypotheses  Repeating  our  earlier  explanation  of  what  this  means,  FIS  finds  all  nodes 
N  in  the  foundations  of  the  consequent  of  the  conditional  proof  justification  such  that  (I)  N 
is  not  one  of  the  hypotheses  or  one  of  their  rejsercussions.  and  (2)  N  Is  either  an  antecedent 
of  the  consequent  or  an  antecedent  of  some  node  in  the  repercussions  of  the  hypotheses. 
The  in  nodes  in  this  set  form  the  fnlist  of  the  equivalent  SL-justification,  and  the  out  nodes 
of  the  set  form  the  euMist  of  the  equivalent  SL  justification 

Let  (CP  C  |H  OM)  ire  a  valid  CP  justification,  where  C  Is  the  consequent  node, 
IH  is  l  he  list  of  fn  hypotheses,  and  OH  is  the  list  of  euthypotheses  The  steps  of  FIS  are  as 
follows 

Step  1  Mark  t hr  hypot Acres  Mark  each  of  the  nodes  rn  IH  and  OH  wrth  both  an  E 
(examined)  mark  and  a  S  (ri/fwdinafei)  mark,  then  proceed  to  Srep  2.  (o  The  E  mark 
means  that  the  node  has  been  examined  by  the  procedure  We  i  tt  to  make  the 
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search  through  the  foundations  of  C  efficient  The  S  mark  means  that  the  node  is 
either  one  of  the  hypotheses  or  a  repercussion  of  one  of  the  hypotheses  cj 
Step  2.  Mark  tkt  foundations  Call  the  following  subprocedure  on  C.  and  proceed  to  Step 
3 

Step  2a  Matk  tkt  repercussions  of  tkt  kypotkeses  If  the  node  has  an  E  mark,  return 
If  the  node  has  no  E  mark,  mark  It  with  the  E  mark,  and  call  Step  2a  on  each  of 
the  antecedents  of  the  node  If  any  of  the  antecedent  nodes  is  marked  with  an  S 
mark,  mark  the  current  node  with  an  S  mark.  Finally,  return  [o  This  step  marks 
those  nodes  in  both  the  foundations  of  C  and  the  repercussions  of  the  hypotheses 
*1  ' 

Step  3.  Unmark  tkt  foundations  Using  a  recursive  Kan.  similar  to  Step  2a.  remove  the  E 
marks  from  the  foundations  of  C  and  proceed  to  Step  1 
Step  4  Remark  tkt  kypotkeses  As  in  Step  I.  mark  the  hypotheses  with  E  marks,  this  time 
Ignoring  their  S  marks  Proceed  to  Step  5 

Step  5  Collect  tkt  ntt  support  Call  the  following  subprocedure  on  C  and  proceed  to  Step 
6 

Step  5a  Skip  rrptrcussions  and  collect  support  If  the  node  has  an  E  mark,  return 
Otherwise,  mark  (he  node  with  an  E  mark  If  the  node  has  no  S  mark,  add  it  to  IS 
if  It  Is  in.  and  to  OS  if  it  is  out.  then  return  If  the  node  has  an  S  mark,  execute 
step  5a  on  each  of  its  antecedents,  then  return  [e  This  step  collects  just  those  nodes 
in  the  foundations  of  C  which  are  not  hypotheses  or  their  repercussions,  and  which 
directly  support  (are  antecedents  oO  repercussions  of  the  hypotheses  These  nodes 
are  exactly  the  nodes  necessary  to  make  the  argument  go  through  for  C  from  the 
hypotheses 

Step  6  Clean  up  and  mum  tkt  rtsult  Repeat  Step  3.  removing  both  E  and  S  marks, 
remove  all  marks  from  the  nodes  in  IH  and  OH.  and  return  the  justification 
ISL  IS  OSI 

End  of  tkt  Find  Independent  Support  procedure 
4.  Dependency -Directed  Backtracking 

When  the  TMS  makes  a  contradiction  node  fn.  it  invokes  dependency-directed  backtracking 
to  find  and  remove  at  least  one  of  the  current  assumptions  In  order  to  make  the 
contradiction  node  out  The  steps  of  this  process  follow  As  above,  we  enclose  commentary 
in  bracket-asterisk  pairs  ((>.  •)]) 

Step  I  Find  tkt  maximal  assumptions  Trace  through  the  foundations  of  the  contradiction 
node  C  to  find  the  set  5  -  \A/.  ...  4„|.  which  contains  an  assumption  A  if  and  only  If  A 
is  in  C's  foundations  and  there  is  no  other  assumption  B  In  the  foundations  of  ~  such 
that  A  is  in  the  foundations  of  B  We  call  S  the  set  of  the  maximal  assumptions 
underlying  C.  c-J 

[  Just  as  the  TMS  relies  on  the  problem  solving  program  to  point  out 
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inconsistencies  by  marking  cettain  nodes  as  coniradictions,  it  also  relies  on  the  problem 
solver  to  use  non  monoiomc  assumptions  for  any  beliefs  to  which  backtracking  might 
apply  Because  thr  TMS  dors  not  inspect  fhf  statements  represented  by  its  nodes,  it 
foregoes  the  ability,  for  example,  to  retract  premise  justifications  of  nodes  o] 

Step  2  5n*n"i.!r<rr  the  tauit  of  the  inconsisttruy  If  no  previous  backtracking  attempt  on  C 
discovered  5  to  be  the  set  of  maximal  assumptions,  create  a  new  node  NG,  called  a 
negoev/,  to  represent  the  inconsistency  of  S  l  We  call  5  the  nogood  srt  o]  If  5  was 
encountered  earlier  as  a  nogood  set  of  a  contradiction,  use  the  previously  created 
nogood  node  [  Since  C  represents  a  false  statement.  NC  represents 

a  St (An)?faht, 


or 

(I)  -  ($t(dj)  A  ...  A  St (/<„)) 

by  a  simple  rewriting  cj 


Justify  NG  with 

(2)  (CPC  5  0 > 

[  With  this  justification.  NG  will  remain  in  even  after  Step  3  makes  one  of  the 
assumptions  cur.  since  the  CP  justification  means  that  NG  does  not  depend  on  any  of 
the  assumptions  I 

Step  3  Select  and  ltjecl  a  culprit  Select  some  Ar  the  culprit,  from  5  Let  f>j . be  the 

out  nodes  in  the  outlist  of  Af s  supporting-justification  Select  Dj  from  this  set  and 
justify  it  with 

(SI  <SL  (NO  A,  ...  At.,  A,.,...  An )  (D,  ...  t)f,  Dj,,  ...  f>4  II 

(  If  one  takes  these  under  lying  P  nodes  as  "denials'  of  the  selected  assumption,  this 
step  recalls  redudto  ad  absurdum  The  backtracker  attempts  to  force  the  culprit  cut  by 
invalidating  its  supporting  justification  with  the  new  justification,  which  is  valid 
whenever  the  nogood  and  the  other  assumptions  are  in  and  the  other  denials  of  the 
culprit  are  out  If  the  backtracker  erred  in  choosing  the  culprit  or  denial,  presumably  a 
future  contradiction  will  involve  P^  and  the  remaining  assumptions  in  its  foundations 
However,  if  the  m/tlist  of  the  justification  (3)  is  nonempty.  P^  will  be  an  assumption,  of 
higher  level  than  the  remaining  assumptions,  and  so  will  be  the  first  to  be  denied 

The  cunent  implementation  picks  the  culprit  and  denial  randomly  from  the 
alternatives,  and  so  relies  on  blind  search  Blind  search  is  inadequate  for  all  but  the 
simplest  soils  of  problems,  for  typically  one  needs  to  make  a  guided  choice  among  the 
alternative  revisions  of  beliefs  I  will  return  to  this  problem  in  Section  8  cj 

Step  4  Rrptat  if  ntcenary  If  the  TMS  finds  other  arguments  so  that  the  contradiction 
node  C  remains  /n  after  the  addition  of  the  new  justification  for  [)j.  repeat  this 
backtracking  jirocedure  l  Presumably  the  previous  culprit  Ai  will  no  longer  be  an 
assumption  )  Finally,  if  the  contradiction  becomes  out,  then  hah.  or  if  no  assumptions 
can  be  found  in  C’s  foundations,  notify  the  problem  solving  program  of  an 
unanalytahle  contradiction,  then  hah 
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End  of  the  dependency-directed  backtracking  procedure 

As  an  example,  consider  a  program  scheduling  a  meeting,  to  be  held  preferably  at  10  A  M. 
In  either  room  Ri3  or  801 


N-l 

Tift  mi  -  1000 

(SL  0 

(N-2) ) 

N-2 

TinE(fl)  -  1000 

> 

N-3 

ROOM  (til  -  813 

(SL  0 

(N-AI 

N-A 

R00n(f1>  -  801 

With  only  these  justifications,  the  TMS  makes  N-l  and  N-3  in  and  the  other  two  nodes  out 
Now  suppose  a  previously  scheduled  meeting  rules  out  this  combination  of  time  and  room 
for  the  meeting  by  supporting  a  new  node  with  N-l  and  N-3  and  then  declaring  this  new 
node  to  be  a  contradiction 

N-5  CONTRADICTION  ISL  (N-l  N-3MM 

The  dependency-directed  backtracking  system  traces  the  foundations  of  N-S  to  find  two 
assumptions.  N-l  and  N-3,  both  maximal 

N-6  N0G000  N-l  N-3  (CP  N-5  (N-l  N-3)  (I)  Am  >  (SL  (Mil 

N-A  ROOmm  -801  (SL  (N-G  N-l)  0) 

The  backtracker  creates  N-G  which  means,  in  accordance  with  form  (I)  of  Step  2. 

-umum  -  1008  /v  Roomm  .  813) 

and  justifies  N-G  according  to  form  (2)  above  It  arbitrarily  selects  N-3  as  the  culprit,  and 
justifies  N-3's  only  out  antecedent,  N-A.  according  to  form  (3)  above  Following  this,  the 
TMS  makes  N-l.  N-l,  and  N-G  in.  and  N-2,  N-3.  and  N-5  out  N-G  has  a  CP  Justification 
equivalent  to  a  premise  SL-justification.  since  N-5  depends  directly  on  the  two  assumptions 
N-l  and  N-3  without  any  additional  intervening  nodes 

A  further  rule  now  determines  that  room  801  cannot  be  used  after  all.  and  creates 
another  contradiction  node  to  force  a  different  choice  of  room 


N-7 

contradiction 

(SL  (N-A)  0) 

N-8 

NOCOOO  N-l 

(CP  N-7  (N-l)  0) 

Am  ■  (SL  (N-G)  (>> 

N-2 

Tire  mi  *  1P00 

(SL  (N-8)  (II 

Tracing  backwards  from  N  7  through  N-A.  N-6.  and  N-l,  the  backtracker  finds  that  the 
contradiction  depends  on  only  one  assumption.  N-l  It  creates  the  nogood  node  N-8, 
justifies  It  with  a  CP  justification,  in  this  case  equivalent  to  the  SL-justlflcatlon 
(SL  (N-G)  D)  since  N-7's  foundations  contain  N-G  and  N-l’s  repercussions  don't.  The 
loss  of  belief  In  N-l  carries  N-5  away  as  well,  for  the  TMS  makes  N-2,  N-3.  N-G.  and  N-8  In, 
and  N-l,  N-A,  N-5,  and  N  7  out 
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Long  or  extremely  detailed  argument*  are  usually  unintelligible  When  possible,  able 
expositor*  make  their  explanations  intelligible  by  structuring  them  Into  rlearly  separated 
levels  of  detail,  in  which  explanations  of  major  points  consist  of  several  almost-major  points, 
and  so  on.  with  each  item  explained  in  terms  of  the  level  of  detail  proper  to  the  item 
Structuring  arguments  in  this  way  serves  much  the  same  purpose  as  structuring  plans  of 
action  into  levels  of  detail  and  abstraction  Users  of  the  TMS.  or  any  other  means  for 
recording  explanations,  must  take  care  to  convert  raw  explanations  into  structured  ones  If 
the  explanations  lack  structure  initially  Considet.  as  an  exaggerated  example,  a  centralized 
polling  machine  for  use  in  national  elections  At  the  end  of  Election  Day.  the  machine 
reports  that  John  F  Kennedy  has  won  the  election,  and  when  pressed  for  an  explanation  of 
this  decision,  explains  that  Kennedy  won  because  Joe  Smith  voted  for  him.  and  Fannie 
Jones  voted  for  him.  and  Bert  Brown  voted  for  him.  ef  re.'era.  continuing  In  this  way  for 
many  millions  of  voters,  pro  and  con  The  desired  explanation  consists  of  a  summary  total 
of  the  votes  cast  for  Kennedy  Nixon,  and  the  other  candidates  If  pressed  for  further 
explanations,  breakdown*  of  these  totals  into  state  totals  follow  The  next  level  of 
explanation  expands  into  city  lotah,  and  only  if  utterly  pressed  should  the  machine  break 
the  results  into  prectncts  or  individual  voters  for  some  place,  say  Cook  County 

One  can  summarize  the  arguments  and  explanations  recorded  in  the  TMS  by 
using  conditional  proofs  to  subtract  node*  'low  level'  details  from  arguments 

Summanrattons  can  be  performed  on  demand  by  creatlt,g  a  new  node,  and  justifying  this 
node  with  a  CP  justification  mentioning  the  node  to  be  explained  as  its  consequent,  and  the 
set  of  nodes  repiesenting  the  unwanted  low  level  beliefs  as  tts  In  and  cue  (hypotheses  The 
effective  explanation  for  Mre  new  node  via  a  SL  justification  computed  from  the 
CP  justification,  will  consist  solely  of  those  high  level  nodes  present  tn  the  well-founded 
argument  being  summarired 

F.xplanations  ran  be  generalired  or  mad>*  more  abstract  by  this  device  as  well,  by 
justifying  the  original  node  in  terms  of  the  new  node,  or  by  justifying  the  original  node 
with  the  new  SL  justification  computed  for  the  new  node  This  new  justification  will  not 
mention  any  of  the  low  level  details  subtrartrd  from  the  original  argument,  and  so  will 
support  the  conclusion  as  a  general  result,  independent  of  Ihe  particular  low-level  details 
used  to  derive  u  For  example,  an  electronic  circuit  analysis  program  might  compute  the 
voltage  gain  of  an  amplifier  by  assuming  a  typical  input  voltage,  using  this  voltage  to 
compute  the  other  circuit  voltages  including  the  output  voltage,  computing  the  voltage  gain 
as  the  ratio  of  the  output  voltage  to  the  input  voltage,  and  finally  justifying  the  resulting 
value  for  the  gain  using  a  conditional  proof  of  the  output  voltage  value  given  the 
hypothesized  input  voltage  value  This  would  leave  the  gain  value  depending  only  on 
rharartrristics  of  the  circuit,  not  on  the  particular  input  voltage  value  used  in  the 
computation 

Returning  fo  the  eleit'on  example  ahovr,  summarizing  (hr  lection  result  by 
subtracting  out  alt  the  individual  voter’s  ballots  leaves  the  argument  empiy,  for  presumably 
the  intermediate  results  were  computed  solely  In  terms  of  fhe  Individual  ballots  In  order  to 
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summarize  an  explanation,  one  must  know  the  form  of  the  desired  summarization  While 
this  analytical  knowledge  is  frequently  unavoidable,  we  typically  can  reduce  its  scope  by 
Introducing  structure  into  arguments  during  their  creation  To  illustrate  this  point,  we 
explain  how  one  simple  structuring  technique  works  smoothly  with  socalled  structured 
descriptions  to  easily  produce  perspicuous  explanations 

For  this  discussion,  we  take  a  structured  description  to  consist  of  a 
description  item  (sometimes  termed  a  "node’  in  the  knowledge-representation  literature,  but 
we  reserve  this  term  fcr  TMS  nodes),  a  set  of  roles  items  representing  the  parts  of  the 
description,  and  a  set  of  local  inference  rules  These  roles  frequently  represent  entitles 
associated  with  the  description.  For  example,  a  PERSON  description  may  have  a 
MOTHER  role,  and  an  ADDER  description  may  have  roles  for  ADDEND.  AUGEND,  and 
SUM 

To  structure  explanations,  we  draw  an  analogy  between  the  parts  of  a  description 
and  the  calling  sequence  of  a  procedure  We  associate  one  TMS  node  with  each 
description  Item  and  two  TMS  nodes  with  each  role  item  We  will  use  the  node  associated 
with  a  description  item  to  mark  the  arguments  internal  to  the  description,  as  explained 
shortly  We  separate  the  nodes  for  role  items  into  two  sets,  corresponding  to  the  external 
"calling  sequence"  and  the  internal  'formal  parameters*  of  the  procedure  We  use  one  of  the 
nodes  associated  with  each  role  item  to  represent  the  external  system  s  view  of  that 
"argument"  to  the  procedure  call,  and  the  other  node  associated  with  the  role  item  to 
represent  the  procedure’s  view  of  that  "formal  parameter*  of  the  procedure  Then  we 
organize  the  problem  solving  program  so  that  only  the  procedure  and  its  internal  rules  use 
or  justify  the  internal  set  of  nodes,  and  that  all  other  descriptions  and  procedures  use  or 
justify  only  the  external  set  of  nodes  The  motivation  for  this  separation  of  the  users  and 
justifiers  of  two  sets  of  nodes  into  internal  users  and  external  users  is  that  we  can  structure 
arguments  by  transmitting  information  between  these  two  sets  of  nodes  in  a  special  way.  as 
we  now  describe 

Let  D  be  the  node  associated  with  the  description,  and  let  L(  and  be 
corresponding  external  and  internal  role  item  nodes  We  justify  D  to  indicate  the  reason  for 
the  validity  of  the  description  To  distinguish  internal  arguments  from  externa!  arguments, 
we  Justify  lt  with 

ISL  ID  £,)  in. 

This  makes  all  portions  of  arguments  internal  to  the  description  depend  on  D  With  the 
Internal  arguments  marked  In  this  way.  we  can  separate  them  from  other  arguments  when 
transmitting  Information  from  the  internal  nodes  to  the  external  nodes  We  justify  E(  with 

fsin  f(  idi  in 

This  Justification  subtracts  all  internal  arguments  from  the  explanation  of  Er  and  replaces 
them  with  the  single  node  D 

For  example,  suppose  the  hypothetical  voting  program  above  computed  the  vote 
totals  for  Somewhere,  Illinois  by  summing  the  totals  from  the  three  precincts  A,  B.  and  C 
The  program  Isolates  this  level  of  the  computation  from  the  precinct  ccimjiutations  by  using 
an  ADDER  description  to  sum  these  subtotals 
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N-l 

AOdCR  DESCRIPTION  AD 

•  •  • 

Somnuhtrt.  Ill 

N-2 

EXTERNA!  A  OF  AD  -  S00 

•  •  • 

Prttincf  4 

N-3 

EXTERNAL  B  OF  AD  -  ?00 

•  •  • 

Precintl  B 

N-4 

EXTERNAL  C  OF  AD  -  700 

•  •  • 

Precinct  C 

Her*  the  computation*  for  the  precinct  totals  justify  the  three  precinct  totals  The  program 
then  transmits  these  values  to  nodes  representing  the  internal  components  of  the  adder 
description,  and  a  local  rule  of  the  description  computes  the  value  of  the  sum  component 


N-S 

INTERNAL  a  of  AO  ■  S00 

(SL 

(N-l  N-2) 

01 

N-G 

INTERNAL  0  OF  AO  -  200 

(SL 

(N-l  N-3) 

(II 

N-7 

INTFRNAl  C  OF  AO  -  700 

(SL 

(N-l  N-4) 

<11 

N-8 

A*B  OF  AO  -  700 

(SL 

(N-S  N-61 

(1)  intermediate  result 

N-9 

1NT1RNAI  Sin  OF  AO  -  1400 

(SL 

(N-7  N-8) 

01 

The  program  transmits  this  value  for  the  sum  to  the  node  representing  the  external  form  of 
the  result 

N-18  EXTERNAL  SUT10F  AC  -  1400  ISUnN-9  IM-ll  m 

hot  ■  (SL  IN-1  N-2N-3N-4I  (II 

The  SUM  justification  for  N-10  subtracts  all  dependence  on  any  internal  computations 
made  by  the  adder.  N  I  The  resulting  explanation  for  N-10  includes  only  N-l,  N-2,  N-3. 
and  N-4  In  cases  involving  more  complex  procedures  than  adders,  with  large  numbers  of 
Internal  nodes  and  computations  of  no  interest  to  the  external  systrm.  the  use  of  this 
technique  for  structuring  explanations  into  levels  of  detail  might  make  the  difference 
between  an  intelligible  explanation  and  an  unintelligible  one 

6  Dialectical  Arguments 

Quine  (41)  has  stressed  that  we  can  reject  any  of  our  beliefs  at  the  expense  of  making 
suitable  changes  in  our  other  beliefs  For  example,  we  eithet  can  change  our  beliefs  to 
accomodate  new  obser vations.  or  can  reject  the  new  observations  as  hallucinations  or 
mistakes  Notoriously,  philosophical  arguments  have  argued  almost  every  philosophical 
conclusion  at  the  expense  of  other  propositions  Philosophers  conduct  these  arguments  in  a 
discipline  called  dialectial  argumentation,  in  which  one  argues  for  a  conclusion  In  two  steps; 
first  producing  an  argument  for  the  conclusion,  then  producing  arguments  against  the 
arguments  for  the  opposing  conclusion  In  this  discipline,  each  debater  continually 
challenges  those  proposed  arguments  which  he  does  not  like  by  producing  new  arguments 
which  either  challenge  one  or  more  of  the  premises  of  the  challenged  arguments,  or  which 
challenge  one  or  more  steps  of  the  challenged  argument  We  can  »•  *  each  debater  as 
following  this  simplified  procedure 
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Step  I  Make  an  argument  Put  forward  an  argument  A  for  a  conclusion  based  on  premises 
thought  to  be  shared  between  the  debaters 

Step  2  Reply  to  challenges  When  some  debater  challenges  either  a  premise  or  a  step  of  A 
with  an  argument  B.  either  (I)  make  a  new  argument  for  the  conclusion  of  A,  or  (2) 
make  an  argument  for  the  challenged  premise  or  step  of  A  by  challenging  one  of  the 
premises  or  steps  of  B 

Step  3  Repeat  Continue  to  reply  to  challenges,  or  make  new  arguments 

In  this  section  we  show  how  to  organue  a  problem  solving  program's  use  of  the  TMS  into 
the  form  of  dialectical  argumentation  Several  important  advantages  and  consequences 
motivate  this  As  the  first  consequence,  we  can  reject  any  belief  in  a  uniform  fashion,  simply 
by  producing  a  new.  as  yet  unchallenged,  argument  against  some  step  or  premise  of  the 
argument  for  the  belief  We  were  powerless  to  do  this  with  the  basic  TMS  mechanisms  in 
any  way  other  than  physically  removing  justifications  from  the  belief  system  This  ability 
entails  the  second  consequence,  that  we  must  explicitly  provide  ways  to  choose  what  to 
believe,  to  select  which  of  the  many  possible  revisions  of  our  beliefs  we  will  take  when 
confronting  new  information  Quine  has  urged  the  fundamentally  pragmattc  nature  of  this 
question,  and  we  must  find  mechanisms  for  stating  and  using  pragmatic  (relief  revision 
rules  As  the  third  consequence  of  adopting  this  dialectial  program  orgamration,  the  belief 
system  becomes  additive  The  system  never  discards  arguments,  but  accumulates  them  and 
uses  them  whenever  possible  This  guides  future  debates  by  keeping  them  from  repeating 
past  debates  But  the  arguments  alone  comprise  the  belief  system,  since  we  derive  the 
current  set  of  beliefs  from  these  arguments  Hence  all  changes  to  beliefs  occur  by  adding 
new  arguments  to  a  monotomcally  growing  store  of  arguments  Finally,  as  the  fourth 
consequence,  the  inference  system  employed  by  the  program  becomes  modular  We  charge 
each  component  of  the  inference  system  with  arguing  for  its  conclusion  and  against 
opposing  conclusions  On  this  view,  we  make  each  module  be  a  debater  rather  than  an 
inference  rule 

We  implement  dialectical  argumentation  in  the  TMS  by  representing  steps  of 
arguments  both  by  justifications  and  by  beliefs  To  allow  us  to  argue  against  argument 
steps,  we  make  these  beliefs  assumptions 

Suppose  some  module  wants  to  justify  node  N  with  the  justification  ISL  /  01 
Instead  of  doing  this  directly,  the  module  crratrs  a  new  node.  J .  representing  the  statement 
that  /  and  0  SL  justify  N.  in  other  words,  that  belief  in  each  node  of  /  and  lack  of  belief  In 
each  node  of  O  constitute  a  reason  for  believing  in  N  The  module  justifies  <V  with  the 
justification  ISl  /•/  01.  where  J-l  rrpresenls  the  list  /  augmented  by  /  The  TMS  will 
make  N  in  by  reason  of  this  justification  only  if  J  is  in  The  module  then  cieates  another 
new  node.  -J.  representing  the  statement  that  J  represents  a  challenged  justification 
Finally,  the  module  justifirt  J  with  ihe  justification  (SL  U  l-yil  In  this  way,  the 
module  makes  a  new  node  to  repiesent  the  justification  as  an  explicit  belief,  and  then 
assumes  that  the  justification  has  not  been  challenged 

For  example  suppose  a  module  wishes  to  conclude  that  X»3  from  X«YH  and  Y»l. 
In  the  dialectial  use  rf  the  TMS.  II  proceeds  as  follows 
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N-l  XvY.A 

N-2  Y-l 

N-3  X-3  fSL  <N-A  N-i  N-21  (II 

N-4  <N-1 1  AND  IN-21  SI- JUSTIFY  N-3  (SI  (I  IN-SI » 

N-S  N-A  IS  CHALLENGtO  no  /unifications  yet 

Since  N  S  has  no  justifications,  it  is  cut.  so  N- A.  and  hence  N-3,  are  in 

In  thu  discipline,  conflicts  can  be  resolved  either  by  challenging  premises  of 
arguments,  or  by  challenging  those  justifications  which  represent  argument  steps  Actually, 
premise  justifications  for  nodes  now  become  assumptions,  for  the  explicit  form  of  the 
premise  justification  is  itself  assumed  In  either  case,  replies  to  arguments  invalidate  certain 
justifications  by  justifying  the  nodes  representing  the  challenges  The  proponent  of  the 
challenged  arguo^nt  can  reply  by  challenging  some  justification  in  the  challenging 
argument 

This  way  of  using  the  TMS  clearly  makes  blind  dependency  directed  backtracking 
useless,  since  the  number  of  assumptions  supporting  a  node  becomes  very  large  Instead,  see 
must  use  more  refined  procedures  for  identifying  certain  nodes  as  the  causes  of 
inconsistencies  I  will  return  to  this  issue  in  Section  8 

7  Models  of  Other's  Reliefs 

Many  problem  solving  tasks  require  us  to  reason  about  the  beliefs  of  some  agent 
For  example  according  to  the  speech  act  throty  of  purposeful  communication,  I  must  reason 
about  your  beliefs  and  wants,  and  about  your  beliefs  about  my  beliefs  and  wants  15,  19] 
This  requirement  entails  the  ability  to  reason  about  embedded  belief  and  want  spaces,  so 
called  because  these  are  sets  of  beliefs  reported  as  comjround  or  embedded  statements  of 
belief,  for  example.  T  believe  that  you  believe  that  rt  is  ralntng  *  In  fact,  I  must  frequently 
reason  about  my  own  system  of  beliefs  and  wants.  In  planning,  I  must  determine  what  I 
will  believe  and  want  after  performing  some  actions,  and  this  requires  my  determining  how 
the  actions  affect  my  beliefs  and  wants  In  explaining  my  actions,  I  must  determine  what  I 
believed  and  wanted  at  some  time  in  the  past,  before  performing  the  intervening  actions. 
And  when  choosing  what  to  do,  want  or  believe.  I  must  reason  about  what  I  now  am  doing, 
wanting,  or  believing 

fn  making  a  problem  solver  which  utct  such  models  of  belief  systems,  we  face  the 
problem  of  how  to  describe  how  additions  to  these  models  affect  the  beliefs  contained  in 
them,  how  belief  revision  proceeds  within  a  model  of  a  belief  system  It  would  be  extremely 
convenient  if  the  same  mechanism  by  which  the  program  revises  its  own  beliefs,  namely  the 
TMS.  could  be  applied  to  revising  these  models  as  well  Fortuitously,  the  mechanism  of 
representing  justifications  as  rxplicit  beliefs  introduced  in  Section  S  lets  us  do  just  that 

To  represent  a  belief  system  within  our  own,  we  use  beliefs  in  our  own  system 
about  the  beliefs  and  justifications  in  the  other  system  We  then  mirrtr  'he  other  system's 
justifications  of  its  (reliefs  by  making  corresponding  justifications  in  ou.  system's  TMS  of 
our  beliefs  about  the  other  system's  beliefs  For  each  node  N  In  an  agent  U't  belief  system. 
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we  make  two  nodes.  UB{A/]  and  -UB[A/].  one  represenling  (hat  U  believes  in  N.  and  the 
other  representing  that  U  doesn’t  believe  in  N  We  justify  -'UB[N)  with 
(SL  (I  (UB(A/J)),  thus  assuming  that  all  nodes  in  U's  system  are  out  until  given  valid 
Justifications  For  each  SL-justification  J  (•  (SL  /  01)  for  N  In  U's  belief  system,  we  make 
a  node  UB[/]  representing  that  U's  belief  system  contains  J  We  then  justify  UB[AJ J  with 
the  Justification  (SL  L  (II.  where  L  contains  the  node  UB(/1  the  nodes  UB(Af)  for  each 
node  M  In  /,  and  the  nodes  -UB[Af)  for  each  node  M  In  0 

We  might  view  this  technique  as  embodying  an  observation  of  traditional  modal 
logics  of  belief  Most  of  these  logics  include  an  axiom  schema  about  the  belief  modality  Bel 
of  the  form 


Bel (p^qlalBel IplaBel fql) 

When  we  mirror  embedded  justifications  with  TMS  Justifications,  we  are  making  an 
Inference  analogous  to  the  one  licensed  by  this  axiom 

For  example,  suppose  the  program  believes  that  an  agent  U  believes  A.  that  U 
does  not  believe  B.  and  that  U  believes  C  because  he  believes  A  and  doesn't  believe  B  If  we 
looked  Into  U's  TMS  we  might  see  the  following  nodes  and  Justifications 

B  •  •  •  •  • . 

C  ...  (SL  (A)  IBM 


Our  program  represents  this  fragment  of  U's  belief  system  as  follows 


N-l 

UBIA) 

. . .  UB  means  1)  Mltvti 

N-2 

-UB  fBI 

(SL  1)  (N-3)  1 

N-3 

UB(B) 

no  fuiti(i<ation  yet 

N-A 

UBffAl  AND  fBI  SL-JUSHFVCl 

•  *  • 

N-5 

UBIC1 

(SL  IN-A  N-l  N-2)  0) 

In  this  case,  N-l.  N-2.  N-A.  and  N-5  are  in.  and  N-3  is  out  If  the  program  revises  Its  beliefs 
to  that  N-2  is  out.  say  by  the  addition  of  a  new  justification  in  U's  belief  system, 

N-5  UBI...  SL-JUSTIFVB) 

N-2  UBIBI  (SL  IN-6  ...»  U) 

then  the  TMS  will  make  N-S  out  as  well  In  this  way,  changes  made  In  particular  beliefs  In 
the  belief  system  lead  automatically  to  other  changes  in  beliefs  which  represent  the  implied 
changes  occurring  within  the  belief  system 

Of  course,  we  can  repeat  this  technique  at  each  level  of  embedded  belief  spaces. 
To  use  this  technique  we  must  require  the  Inference  rules  which  draw  conclusions  Inside  a 
belief  space  to  assert  the  corresponding  beliefs  about  Justifications  for  those  conclusions 


One  frequently  assumes  that  others  have  the  same  set  of  Inference  rules  as  oneself,  that  they 
can  draw  the  same  set  of  inferences  from  the  same  set  of  hypotheses  This  assumption 
amounts  to  that  of  assuming  that  everyone  operates  under  the  same  basic  'program'  but 
has  different  data  or  initial  beliefs  I  am  currently  exploring  a  formalization  of  this 
assumption  in  an  'introspective*  problem  solver  which  has  a  description  of  itself  as  a 
program,  and  which  uses  this  self  description  as  the  basis  of  its  models  of  the  behavior  of 
others  (16) 

8  Assumptions  and  the  Problem  of  Control 

How  a  problem  solver  revises  its  beliefs  influences  how  it  acts  Problem  solvers  typically 
revise  their  beliefs  when  new  information  (such  as  the  expected  effect  of  an  action  just  taken 
or  an  observation  just  made)  contradicts  previous  beliefs  These  Inconsistencies  may  be  met 
by  rejecting  the  belief  that  the  action  occurred  or  that  the  observation  occurred  This  might 
be  thought  of  as  the  program  deciding  it  was  hallucinating  Sometimes,  however,  we  choose 
to  reject  the  previous  belief  and  say  that  the  action  made  a  change  in  the  world,  or  that  we 
had  made  some  inappropriate  assumption  which  was  corrected  by  observation  Either  of 
these  ways  of  revising  beliefs  may  be  warranted  m  different  circumstances  For  example,  if 
during  planning  we  encounter  a  contradiction  by  thinking  through  a  proposed  sequence  of 
actions,  we  might  decide  to  reject  one  of  the  proposed  actions  and  try  another  action  On 
the  other  hand,  if  while  carrying  out  a  sequence  of  actions  we  encounter  a  contradiction  in 
our  beliefs,  we  might  decide  that  some  assumption  we  had  about  the  world  was  wrong, 
rather  than  believe  that  *r  never  took  the  last  action  As  this  example  suggests,  we  might 
choose  to  revise  our  beliefs  in  several  diffrrrnt  ways  Since  we  decide  what  to  do  based  on 
what  we  believe  and  what  wp  want,  our  choice  of  what  to  believe  affect  what  we  choose  to 
do 

How  can  we  guide  the  problem  solver  in  its  choice  of  what  to  believe*  It  must 
make  its  choice  by  approximating  the  set  of  possible  revisions  by  the  set  of  assumptions  It 
can  change  directly,  for  it  cannot  see  beforehand  all  the  consequences  of  a  change  without 
actually  making  that  change  and  seeing  what  happens  We  have  studied  two  means  by 
which  the  problem  solver  can  decide  what  to  believe,  the  technique  of  encoding  control 
Information  into  the  set  of  justifications  for  beliefs,  and  the  technlqv*  of  using  explicit 
choice  rules  Roth  of  these  approaches  amount  to  having  the  reasoner  deliberate  about 
what  to  do  In  the  first  case,  the  reasoning  is  "canned*  In  the  second,  the  reasoning  Is 
performed  on  demand 

We  encode  some  control  information  into  the  set  of  justifications  for  beliefs  by 
using  paiterns  of  non  monotonic  justifications  We  can  think  of  a  non  monotonic 
justification  (SI  ft  (N  ?  N- 31 1  for  N  I  as  suggesting  the  order  in  which  rhese  nodes 
should  he  believed,  N- 1  first,  then  N  ?  or  N-3  second  On  this  view,  each  non  monotonic 
justification  contributes  a  fragment  of  toni'ol  information  whkh  guides  how  the  problem 
solver  revises  its  beliefs  In  Sections  81.  82  and  8  3  we  illustrate  ho-  o  encode  several 
standard  control  structures  in  patterns  of  justifications,  namely  detault  assumptions, 
sequences  of  alternatives,  and  a  way  of  choosing  representatives  of  equivalence  classes  useful 


in  controlling  propagation  of  constraints  (a  deduction  technique  presented  by  fa?))  These 
examples  should  suggest  how  other  control  structures  such  as  decision  trees  01  graphs  might 
be  encoded 

Even  with  these  fragments  of  control  information,  many  alternative  revisions  may 
appear  possible  to  the  problem  solver  In  such  cases,  we  may  wish  to  provide  the  pioblem 
solver  with  rules  or  advice  about  how  to  choose  which  revision  to  make  if  we  are  clever 
(or  laty),  we  might  structure  the  problem  solver  so  that  it  uses  the  same  language  and 
mechanisms  for  these  revision  rules  as  for  rules  for  making  other  choices,  such  as  what 
action  to  perform  next,  how  to  carry  out  an  action,  or  which  goal  to  pursue  next  In  [II]  my 
colleagues  and  I  incorporated  this  suggestion  into  a  general  methodology  which  we  call 
explicit  control  of  reasoning,  and  implemented  AMORD,  a  language  of  pattern-invoked 
procedures  controlled  by  the  TMS  I  am  currently  studying  a  problem  solver  architecture, 
called  a  reflexive  interpreter,  in  which  the  problem  solver's  structure  and  behavior  are 
themselves  domains  for  reasoning  and  action  by  the  problem  solver  [16]  This  sort  of 
interpreter  represents  its  own  control  state  to  itself  explicitly  among  its  beliefs  as  a  task 
network  similar  to  that  used  in  McDermott's  [3<]  NASL,  In  which  problems  or  intentions  are 
represented  as  tasks  The  interpreter  also  represents  to  itself  its  own  structure  as  a  program 
by  means  of  a  set  of  plans,  abstract  fragments  of  task  network  It  represents  the  important 
control  state  of  having  to  make  a  choice  by  creating  a  cheect  task,  whose  carrying  out 
involves  making  a  choice  The  interpreter  can  then  treat  this  choice  task  as  a  problem  for 
solution  like  any  other  task  In  this  fiamework.  we  formulate  rules  for  guiding  belief 
revision  as  plans  foi  carrying  out  choice  tasks  We  index  these  revision  plans  by  aspects  of 
the  problem  solver  state,  for  example,  by  the  historical  state,  by  the  contiol  state,  by  the  state 
of  the  pioblem  solution,  by  the  domain,  by  the  action  just  executed,  and  by  other 
circumstances  Each  revision  plan  might  be  viewed  as  a  speculation  of  the  general 
dependency  directed  backtracking  procedure  Such  refinements  of  the  genriai  backtracking 
procedure  rake  the  form  of  the  beliefs  (and  thus  the  problem  solver  state)  into  account  when 
deciding  which  assumptions  should  be  rejected  I  will  report  the  details  of  my  investigation 
in  my  forthcoming  thesis 

8.1  Default  Assumptions 

Problem  solving  programs  frequently  make  specifications  of  default  values  for  the  quantities 
they  manipulate,  with  the  intention  either  of  allowing  specific  reasons  for  using  other  •values 
to  override  the  current  values,  or  of  rejecting  the  default  if  it  leads  to  an  inconsistency  (See 
[15]  for  a  hicid  exposition  of  some  applications)  The  example  in  Section  12  includes  such  a 
default  assumption  for  the  day  of  the  week  of  a  meeting 

To  pick  the  default  value  fmm  only  two  alternatives,  we  justify  the  default  node 
non  monotomcally  on  the  grounds  that  the  alternative  node  Is  out  We  generalize  this 
binary  case  to  choose  a  default  from  a  larger  set  of  alternatives  Take  S  «  |/fj.  <4n|  to  be 

the  set  of  alternative  nodes,  and  if  desired,  let  G  be  a  node  which  represents  the  reason  for 
making  an  assumption  to  choose  the  default  To  make  /4(  the  default,  justify  it  with 
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<SL  (Gl  [A,  ...  Ah  A(t,  ...  ». 

If  no  additional  information  about  the  value  exult,  none  of  the  alternative  nodes  except  A{ 
will  have  a  valid  justification,  so  At  will  be  In  and  each  of  the  other  alternative  nodes  will 
be  out  Adding  a  valid  justification  to  some  other  alternative  node  causes  that  alternative  to 
become  in,  and  invalidates  the  support  of  Aj,  so  A{  goes  out  When  analyung  a 
contradiction  denved  from  Af.  the  dependency  directed  backtracking  mechanism  recognises 
At  as  an  assumption  because  it  depends  on  the  other  alternative  nodes  being  out  The 
backtiacker  may  then  justify  one  of  the  other  alternative  nodes,  say  Aj.  causing  A(  to  go  out. 
This  backtracker  juoduced  justification  for  Aj  will  have  the  form 

•  SL  <var  j  ous  nodeB>  <rei»ainder  nodes>) 

where  <re*tamrier  nodes*  is  the  set  of  A^t  remaining  in  5  after  Aj  and  Aj  are  taken  away. 
In  effect,  the  backtiacker  removes  the  default  node  from  the  set  of  alternatives,  and  makes  a 
new  default  assumption  fiom  the  remaining  alternatives  As  a  concrete  example,  our 
scheduling  piogram  might  default  a  meeting  day  as  follows 


N-l 

PRfFFRU.  TO  ft.  ORF. 

•  »  • 

N-2 

DAY (Ml  *  nONPAY 

N-3 

[lAYtm  .  UEONFSOAY 

(SL  (N-l  l  (N-2N-4U 

N-4 

OAY(fl)  .  fRIOAY 

The  program  assumes  Wednesday  to  be  the  day  of  the  meeting  M,  with  Monday  and 
Friday  as  alternatives  The  TMS  will  make  Wednesday  the  chosen  day  until  the  program 
gives  a  valid  reason  for  taking  Monday  or  Friday  instead 

We  use  a  slightly  different  set  of  justifications  if  the  complete  set  of  alternatives 
cannot  be  known  in  advance  but  must  be  discovered  piecemeal  This  ability  to  extend  the 
set  of  alternatives  is  necessary,  for  example,  when  the  default  Is  a  number,  due  lo  the  large 
set  of  possible  alternatives  Retaining  the  above  notation,  we  represent  the  negation  of 
Srtdj)  with  a  new  node,  -Aj  We  ariange  for  Af  to  be  believed  If  -* Af  Is  out,  and  set  up 
justifications  so  that  if  A ^  is  distinct  from  Aj,  Aj  supports  -Aj.  We  Justify  Aj  with 

(SL  (GM-4,1). 

and  justify  -4f  with  a  justification  of  the  form 

(SL  (Aj)  m 

for  each  alternative  Aj  distinct  from  A (  As  before.  Af  will  be  assumed  if  no  reasons  for 
using  any  other  alternative  exist  Furthermore,  new  alternatives  can  be  added  to  the  set  J 
simply  by  giving  -Aj  a  new  justification  corresponding  to  the  new  alternative  As  before.  It 
the  problem  solving  program  justifies  an  unselected  alternative,  the  TMS  will  make  the 
default  node  our  Uacktracking,  however,  has  a  new  effect  If  Aj  supports  a  contradiction, 
the  backtracker  may  justify  -4,  so  as  to  make  At  become  out.  When  this  happens,  the  TMS 
has  no  way  to  select  an  alternative  to  take  the  place  of  the  default  assumption  The 
extensible  structure  requires  an  external  mechanism  to  construct  a  new  default  assumption 
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whenever  the  current  default  Is  ruled  out  For  example,  a  family  planning  program  might 
make  assumptions  about  the  number  of  children  in  a  family  as  follows 


N-l  PREFER  2  CHI  LOREN 

N-2  #-CH| LOREN  IF)  »  2 

N-3  0-CH1LORENIF)  -  2 


N-4  0-CHILBRENIF)  .  e 

N-S  0-CHILoRENIF I  -  1 

N-B  0-CHILDRENIF)  -  3 

N-7  0-CHI LOREN (FI  -  U 


•  •  • 

(SL  (N-l I  (N-31 1 
ISL  (N-4)  01 
(SL  (N-SI  (I) 

(SL  IN-61  O) 

(SL  IN-7)  (I) 


With  this  system  of  justifications,  the  TMS  would  make  N-2  /rt  If  the  planning  program 
finds  some  comjiellmg  reason  for  having  3  children,  it  would  have  to  create  a  new  node  to 
represent  this  fact,  along  with  a  new  justification  for  N-3  in  terms  of  this  new  node 

8.2  Sequences  of  Alternatives 

Linearly  ordered  sets  of  alternatives  add  still  more  control  information  to  a  default 
assumption  structuie.  namely  the  order  in  which  (he  alternatives  should  be  tried  This 
extra  heuristic  information  might  be  used,  for  example,  to  order  selections  of  the  day  of  the 
week  for  a  meeting,  of  a  planning  stiatcgy,  or  of  the  state  of  a  transistor  in  a  proposed 
circuit  analysis 

We  represent  a  sequence  of  alternatives  by  a  controlled  progression  of  default 
assumptions  Take  | A/.  .  4„|  to  be  the  heuristically-ordered  sequence  of  alternative  nodes, 
and  let  G  be  a  node  which  represents  the  reason  for  this  heuristic  ordering  We  justify  each 
with 

(SL  (C  -4,.,!  (-4,11 

4j  will  be  selected  initially,  and  as  the  problem  solver  rejects  successive  alternatives  by 
justifying  thru  negations,  the  TMS  will  believe  the  successive  alternatives  In  turn.  For 
example,  our  scheduling  program  might  have 


N-l 

SEQUENCE  N-2N-4  N  6 

•  •  • 

N-2 

cVim  .  uednesoay 

ISL  (N-l)  (N-3)) 

N-3 

N-4 

HAY  mi  *  UEONESQAY 

DAY  mi  .  THURSDAY 

(SL  (N-l  N-31 

(N-SM 

N-S 

N-G 

DAYim  «  THURSDAY 
OAYtm  -  TUFSOAY 

(SL  (N-l  N-S) 

m 

This  would  guide  (he  choicr  of  day  for  the  meeting  M  to  Wednesday.  Thursday  and 
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Tuesday,  in  that  older 

Note  that  this  way  of  sequencing  through  alternatives  allows  no  direct  way  for  the 
problem  solving  piogtam  to  reconsider  previously  rejected  alternatives  If.  say,  we  wish  to 
use  special  case  rules  to  conect  imprudent  choices  of  culprits  made  by  the  backtracking 
system,  we  need  a  more  complicated  structure  to  represent  linearly  ordered  alternatives  We 
create  three  new  nodes  for  each  alternative  A{  PAr  which  means  that  A(  is  a  possible 
alternative.  NS  Af.  which  means  that  At  is  not  the  currently  selected  alternative,  and  ROAt, 
which  means  that  At  is  a  ruled-out  alternative  We  suggest  members  for  the  set  of 
alternatives  by  justifying  each  PAf  with  the  reason  for  including  At  in  the  set  of 
alternatives  We  leave  each  ROAt  unjustified,  and  justify  each  At  and  NSA(  with 

At  (SI  tPA'NSA/...  NSA(.,I  (ROA^I 

NSAt  (SL  (I  ( PAtD 

(SI  iROAfl  in 

Hete  the  justification  for  A(  is  valid  if  and  only  if  A{  is  an  alternative,  no  better  alternative 
is  currently  selected,  and  A  is  not  ruled  otit  The  two  justifications  for  NSA i  mean  that 
eithei  A(  is  not  a  valid  alternative,  ot  that  Af  is  tuled  out  With  this  structure,  different 
parts  of  the  ptoblem  solver  can  independently  rule  in  or  rule  out  an  alternative  by 
justifying  the  appropriate  A  or  ROA  node  In  addition,  we  can  add  new  alternatives  to  the 
end  of  such  a  linear  order  by  constructing  justifications  as  specified  above  for  the  new 
nodes  representing  the  new  alternative 

8  5  Equivalence  Class  Representatives 

Problem  solvers  organited  to  encourage  modularity  and  additivity  frequently  contain 
several  different  methods  or  rules  which  compute  values  for  the  same  quantity  or 
descriptions  for  the  same  object  We  call  these  multiple  results  coincidences,  after  (9.  b9l  If 
the  several  methods  compute  several  values,  we  can  often  derive  valuable  information  by 
checking  these  competing  values  for  consistency  With  polynomials  as  values,  for  example, 
this  consistency  checking  sometimes  allows  solving  foi  the  values  of  one  or  more  variables. 
After  checking  the  coincidence  for  consistency  and  new  information,  prudent  programs 
normally  use  only  one  of  the  suggested  values  in  further  computation,  and  retain  the  other 
values  for  future  reference  The  various  values  form  an  equivalence  class  with  respect  to  the 
propagation  of  the  value  in  other  computations,  and  one  of  the  values  In  this  class  must  be 
chosen  as  the  representative  for  propagation  We  could  choose  the  representative  with  a 
default  assumption,  hut  this  would  lead  to  undesirable  backtracking  behavior.  For  instance, 
if  (he  backtracking  system  finds  the  equivalence  class  representative  Involved  In  an 
inconsistency,  then  it  should  find  some  way  of  rejecting  the  representative  as  a  proper  value, 
rather  than  letting  it  stand  and  selecting  a  new  representative.  This  means  the  backtracker 
should  find  the  choice  of  representative  invisible,  and  this  requirement  rules  out  using 


richer  the  default  assumption  or  sequence  of  alternatives  representations 

We  select  equivalence  class  representatives  by  using  conditional  proof  justifications 
to  hide  the  choice  mechanism  from  the  backtracking  system.  For  each  node  R,  representing 
a  equivalence  class  member,  we  create  two  new  nodes:  PR,.  which  means  that  R,  Is  a 
possible  representative,  and  SR,.  which  means  that  R,  Is  the  selected  representative.  Rather 
than  the  program  deriving  justifications  for  the  R  nodes  directly.  It  should  instead  suggest 
these  values  as  possible  representatives  by  justifying  the  corresponding  PR  nodes  Instead. 
With  this  stipulation  we  justify  each  Rt  and  SR,  at  follows: 

SR,  (SL  (PR,)  (SR,  ...  SRt.,)  I 

R,  ICP  SR,  I)  1  SR,  ...  SR,.,)) 

Here  the  justification  for  SR,  means  that  R ,  has  been  suggested  as  a  member  of  the 
equivalence  class,  and  .hat  no  other  member  of  the  class  has  been  selected  as  the 
representative  This  justification  constitutes  a  default  assumption  of  R,  as  the  selected 
representative  However,  the  juitrficatron  for  R ,  means  that  the  reason  for  believing  R,  will 
be  the  reason  for  both  suggesting  and  selecting  R,  (the  argument  for  SR,),  minus  the  reason 
for  selecting  It  (the  default  assumption),  thus  leaving  only  the  reason  for  which  R,  was 
suggested,  namely  the  antecedents  of  PR,  In  this  way  the  equivalence  class  selector  picks 
alternatives  as  the  reptesentative  in  rhe  order  in  which  they  were  added  to  the  set  of 
alternatives,  while  hiding  this  selection  from  the  backtracking  system 

For  example.  suppose  a  commodity  analysis  program  derives  two  values  for  the 
predicted  number  of  tons  of  wheat  grown  this  year  and  notices  this  coincidence 


N-l 

SUGGEST  UHEAT  11979)  .  SX*3B00 

(SL  (R-S7  ...)  m 

N-2 

SUGGEST  UHEAT  11979)  -  7Y 

(SL  (R-60  ...I  (>> 

N-3 

Y  -  (SX+3000) n 

(SL  (N-l  N-21  (11 

These  suggested  values  correspond  to  possible  equivalence  class  representatives  To  avoid 
using  both  values  in  further  computations,  the  program  chooses  one 


N-4 

N-l  SELECTED 

(SL  (N-l)  0) 

N-S 

UHEAT 11979)  -  SX*3000 

(CPN-4  1)  <>) 

here  ■  (SL  (N-ll  (II 

N-6 

N-2  SELECTEO 

(SL  (N-21  (N-4)  1 

N-7 

UCAT11979)  -  7V 

(CP  N-6  (1  (N-4')  I 

Since  N-l  Is  In  and  it  is  the  first  in  the  ordering  imposed  by  the  selection  justifications.  It  Is 
selected  to  be  the  value  propagated,  and  the  TMS  makes  N-4  and  N-S  in  Suppose  now 
that  some  contradiction  occurs  and  has  N-S  in  Its  foundations,  and  that  the 
dependency  directed  backtracker  denies  some  assumption  In  N-l’s  foundations. 


■ 
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Consequently.  the  TMS  makes  N-l  (and  N-3)  out.  and  N-S  and  N-7  in.  with  N-7's 
CP-justification  equivalent  in  this  case  to  (SL  (N-21  (II.  Thus  the  pattern  of 
justifications  leads  to  selecting  the  second  suggested  value  If  the  program  then  find*  a 
third  value. 

N-8  SUGGEST  WHEAT  (1979)  •  4X+100 

N-9  Y-I4X+100I/7  ISL  (N-2N-8)  () 

N-10  N-8  SELECTED  (SL  (N-8)  (N-4  N-6) ) 

N-21  UHEATI1979)  •  4X+100  (CP  N-10  (I  (N-4  N-GH 

It  will  derive  any  new  information  possible  from  the  new  value,  then  add  the  new  value  to 
the  list  of  waiting  alternative  values  for  propagation  In  this  case,  N-8  and  N-9  are  In,  and 
N-10  and  N-l  1  are  out 

9.  Experience  and  Extensions 

We  have  experience  with  the  TMS  in  a  number  of  programs  and  applications  I 
Implemented  the  first  version  of  the  TMS  in  September  1976,  as  an  extension  (in  several 
ways)  of  the  “fart  garbage  collector"  of  Stallman  and  Sussman's  (53J  ARS  electronic  circuit 
analysts  program  After  that,  l  took  the  program  through  many  different  versions  Howard 
Shrobe  and  James  Stansfield  also  made  improvements  in  the  program  T ruth  maintenance 
techniques  have  been  applied  In  several  other  circuit  analysis  and  synthesis  programs, 
including  SYN  (I?)  and  QJUAL  flOl  and  in  Steele  and  Sussman's  (56)  constraint  language 
We  organired  our  rule  based  problem  solving  system  AMORD  III)  around  the  TMS,  and 
used  AMORD  in  developing  a  large  number  of  experimental  programs,  ranging  from 
blocks  world  problem  solvers  to  circuit  analysis  programs  and  compilers  McAllester  (31) 
uses  his  own  truth  maintenance  system  in  a  program  for  symbolic  algebra,  electronic  circuit 
analysis,  and  programming  In  addition.  Weiner  (62)  of  UCLA  used  AMORD  to 
Implement  an  explanation  system  in  studying  the  structure  of  natural  explanations,  and 
Shrobe  (SO]  uses  AMORD  in  a  program  understanding  system 

Several  researchers  have  extended  the  basic  belief  revision  techniques  of  the  TMS 
by  embedding  them  in  larger  frameworks  which  incorporate  time,  certainty  measures,  and 
other  problem  solving  concepts  and  processes  Friedman  (19)  and  Stansfield  (M)  merge 
representations  of  continuous  degrees  of  belief  with  truth  maintenance  techniques  London 
(29)  and  Thompson  (60)  add  chronological  contexts  to  a  dependency -based  framework. 
London  also  presents  many  detailed  examples  of  the  use  of  dependency  network*  in  the 
modelling  component  of  a  problem  solving  program 

Improvements  in  the  basic  truth  maintenance  process  have  also  been  suggested. 
McAllester  (V))  describes  a  relative  of  the  TMS  based  on  a  three-valued  belief  set.  with 
muhl-dlrectlonal  clauses  as  justifications  Thompson  (60)  generalises  the  node-justification 
structure  of  the  TMS  to  non  clausal  arguments  and  justifications.  Shr  »  On  (50)  and  in 
personal  communications)  has  suggested  several  ways  in  which  the  problem  solver  can 
profit  by  reasoning  about  the  structure  of  arguments,  particularly  in  revising  its  set  of  goals 


after  solving  some  particular  goal  These  ideas  suggest  other  improvements  including  (I) 
modification  of  the  TMS  to  make  use  of  multiple  supporting  justifications  whenever  several 
well-founded  arguments  can  be  found  for  a  node,  (2)  use  of  the  TMS  to  signal  the  problem 
solver  whenevet  the  argument  for  some  node  changes,  and  (3)  development  of  a  language 
for  describing  and  efficiently  lecognmng  patterns  in  arguments  for  nodes,  well  founded  or 
otherwise  How  to  incoipoiate  tiuth  maintenance  techniques  into  "virtual-copy’ 
representational  systems  [|7]  also  seems  worth  study  . 

The  TMS  continually  checks  CP-justifications  for  validity,  in  hopes  of  deriving 
new  equivalent  SL-justlfications  This  makes  the  implementation  considerably  more 
complex  than  one  might  imagine  I  expect  that  a  simpler  facility  would  be  moie  generally 
useful,  namely  the  TMS  without  CP  justifications,  but  with  the  Find  Independent  Support 
procedure  isolated  as  a  separate,  user  invoked  facility  Practical  experience  shows  that  in 
most  cases,  one  only  expects  the  CP  justification  to  be  valid  in  the  situation  in  which  it  is 
created,  so  it  seems  reasonable  to  make  the  user  responsible  for  calling  FIS  directly  rather 
than  letting  the  TMS  do  it 

Finally,  a  cluster  of  problems  center  about  mcrementality  The  TMS  normally 
avoids  *xamining  the  entire  data  base  when  revising  beliefs,  and  instead  examines  only  the 
repercussions  of  the  changed  nodes  However,  apparently  unsatisfiable  circularities  can 
occur  which  require  examining  nodes  not  included  in  these  repercussions  In  another  sense 
of  mcrementality.  some  circumstances  can  force  the  TMS  to  examine  laige  numbers  of 
nodes,  only  to  leave  most  of  them  rn  their  original  state  after  finding  alternate  non  circular 
arguments  for  the  supposedly  changed  nodes  Latombe  (27]  has  investigated  ways  of 
avoiding  this,  but  these  difficulties  deserve  further  study  One  particularly  enticing 
possibility  is  that  of  adapting  the  ideas  of  Baker's  (I]  real-time  list  gaibage-collection 
algorithms  to  the  case  of  truth  maintenance 

10.  Discussion 

The  TMS  solves  part  of  the  belief  revision  problem,  and  provides  a  mechanism  for  making 
non  monotonic  assumptions  Artificial  intelligence  researchers  recognued  caily  on  that  Al 
systems  must  make  assumptions,  and  many  of  their  systems  employed  some  mechanism  for 
this  purpose  Unfortunately,  the  related  problem  of  belief  revision  received  somewhat  less 
study  Hayes  [21]  emphasised  the  imjiortance  of  the  belief  revision  problem,  but  with  the 
exception  of  Colby  [61  who  employed  a  belief  system  with  reasons  for  some  beliefs,  as  well 
as  measuies  of  credibility  and  emotional  importance  for  beliefs,  most  woik  on  revising 
beliefs  ap|>ears  to  have  been  restricted  to  the  study  of  backtracking  algorithms  operating  on 
rather  simple  systems  of  states  and  actions  The  more  general  problem  of  revising  beliefs 
based  on  records  of  inferences  has  only  been  examined  in  more  recent  work,  including  Cox’s 
[7]  graphical  deduction  system.  Crocker’s  [8]  verification  system,  de  Kleet's  [9]  electronic 
circuit  analysis  program.  Fikes'  (18)  deductive  modelling  jystem.  Hayes'  (22)  travel  planning 
system.  Katl  and  Manna's  [2d]  progiam  modification  system.  Latombe's  (26.  27]  design 
program.  London's  [29]  planning  and  modelling  system,  McDermott's  [32,  33,  34]  language 
understanding,  data  base,  and  design  programs.  Moriconl'i  (39)  verification  system.  Nevins’ 
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(10]  theorem  prover,  Shrobe’s  (50)  progiam  under  standmp,  system.  the 
MDSf  AIMDS/BELIF.VF.R  programs  (47,  51.  52],  and  Sussman  and  Stalfman’s  (51.  59] 
electronic  circuit  analysis  programs  Berliner's  [3]  chess  program  employed  “lemmas"  for 
recording  interesting  facts  about  partial  board  analyses  reminiscient  of  conditional -proofs, 
but  the  program  derives  these  lemmas  through  a  perturbation  technique  rather  than 
through  analysis  of  arguments  and  justifications 

In  addition,  the  philosophical  literature  includes  many  treatments  of  belief 
revision  and  related  problems  Many  writers  study  evaluative  criteria  for  judging  which 
belie!  revisions  are  best,  based  on  the  connections  between  beliefs  Quine  and  Ulltan  (43] 
survey  this  area  Other  writers  study  the  problems  of  explanations,  laws,  and  counterfactual 
conditionals  Rescher  (44)  builds  on  Goodman's  (2d]  exposition  of  these  problems  to  present 
a  framework  for  belief  revision  motivated  by  Quine's  (41,  42]  ‘minimum  mutilation’ 
principle  Lewis  (28]  and  Turner  (81)  propose  means  for  filling  In  this  framework  Scrtven 
(48]  relates  these  questions  to  the  problem  of  historical  explanation  in  a  way  quite 
reminiscient  of  our  nonmonotonic  argument  for  beliefs  Suppes  (57)  surveys  work  on 
learning  and  rational  changes  of  belief  The  view  of  reasoning  proposed  in  Section  I  I  Is 
connected  with  many  topics  m  the  thrones  of  belief,  action,  and  practical  reasoning  Minsky 
(37]  presen's  a  theory  of  memory  which  includes  a  more  general  view  of  reasoning 

Kramosil  (25)  initiated  the  mathematical  study  of  non  monotonic  inference  rules, 
but  reached  pessimism  conclusions  More  recently,  McDermott  and  1  (15)  attempt  to 
formalize  the  logic  underlying  the  1  MS  with  what  we  call  non  monotomc  logic  We  also 
survey  the  history  of  such  reasoning  techniques  Weyhrauch  (61]  presents  a  framework  for 
meta  theoretic  reasoning  in  which  these  reasoning  techniques  and  others  can  be  expressed 
Hinrikka  (21)  presents  a  form  of  possible  world  semantics  for  modal  logics  of  knowledge  and 
belief  Moore  [18]  combines  this  semantics  for  knowledge  with  a  modal  logic  of  action,  but 
Ignores  belief  and  belief  revision 

'  One  might  hope  to  find  dues  about  how  to  organize  the  TMS's  analysis  of 
potential  arguments  for  beliefs  by  studying  what  types  of  arguments  humans  find  easy  or 
difficult  to  understand  Statman  (*»*>]  indicates  that  humans  have  difficulty  following 
arguments  which  have  many  back  refetences  to  distant  statements  He  attempts  to  formalize 
some  notions  of  the  complexity  o(  proofs  using  measures  based  on  the  topology  of  the  proof 
graph  Wiener  (62)  catalogues  and  analyzes  a  corpus  of  human  explanations,  and  finds  that 
most  exhibit  a  fairly  simple  structuie  Dr  K  leer  (10)  studies  causal  explanations  of  the  sort 
produced  by  engineers,  and  discovers  that  a  few  simple  principles  govern  a  large  number  of 
these  explanations 

I  have  used  the  term  “belief*  freely  in  this  paper,  so  much  so  that  one  might  think 
the  rule  "Belief  Revision  System"  more  appropriate,  if  no  less  ambitious,  than  "Truth 
Maintenance  System"  Belief,  however,  for  many  people  carries  with  It  a  concept  of  grading, 
yet  the  TMS  has  no  non  trivial  grading  of  beliefs  (Section  9  mentioned  some  extensions 
which  do)  Perhaps  a  mote  accurate  label  would  be  ‘opinion  revision  system’  where  I 
follow  Dennett  (PJ  in  distinguishing  between  binary  judgemental  asseri  is  (opinions)  and 
graded  underlying  feelings  (beliefs)  As  Dennett  explains,  thts  distinction  permits 
description  of  those  circumstances  in  which  reasoned  arguments  force  one  to  assert  a 


conclusion,  even  though  one  dors  not  believe  the  conclusion  Hesitation,  self-deception,  and 
other  complex  states  of  belief  and  opinion  can  be  described  in  this  way  I  feel  it  particularly 
apt  to  characterize  the  TMS  as  revising  opinions  rather  than  beliefs  Choosing  what  to 
"believe"  in  the  TMS  Involves  making  judgements,  rather  than  continuously  accreting 
strengths  or  confidences  A  single  new  piece  of  information  may  lead  to  sizable  changes  in 
the  set  of  opinions,  where  new  beliefs  typically  change  old  ones  only  slightly 

I  also  find  this  distinction  between  binary  judgements  and  graded  approximations 
useful  In  distinguishing  nonmonotonic  reasoning  from  imprecise  reasoning,  such  as  that 
modelled  by  Zadeh's  (6iJ  fuzzy  logic  I  view  the  non  monoton ic  capabilities  of  the  TMS  as 
capabilities  for  dealing  with  incomplete  information,  but  here  the  incompleteness  is  "exact": 
It  makes  binary  statements  about  (typically)  precise  statements  Any  approximation  In  the 
logic  enters  only  when  one  views  the  set  of  current  beliefs  as  a  whole  In  the  logics  of 
imprecise  reasoning,  the  incompleteness  is  "inexact"  the  statements  themselves  are  vague, 
and  the  vagueness  need  not  be  a  property  of  the  entire  system  of  beliefs  While  both 
approaches  appear  to  be  concerned  with  related  issues,  they  seem  to  be  orthogonal  in  their 
current  development,  which  suggests  studies  of  their  combination  (C.f  (19)) 

One  final  not?  The  overhead  requued  to  record  justifications  for  every  program 
belief  might  seem  excessive  Some  of  this  burden  might  be  eliminated  by  using  the 
summariration  techniques  of  Section  S  to  replace  certain  arguments  with  smaller  ones,  or  by 
adopting  some  (hopefully  well  understood)  discipline  of  retaining  only  essential  records  from 
which  all  discarded  information  can  be  easily  recomputed  However,  the  pressing  issue  Is 
not  the  expense  of  keeping  records  of  the  sources  of  beliefs  Rather,  we  must  consider  the 
expense  of  not  keeping  these  records  If  we  throw  away  information  about  derivations,  we 
may  be  condemning  ourselves  to  continually  ^deriving  information  in  large  searches  caused 
by  changing  irrelevant  assumptions  This  original  criticism  of  MICRO  PLANNER  (in 
(S8))  applies  to  the  context  mechanisms  of  CONNIVFR  and  QAf  as  well  If  we  discard  the 
sources  of  beliefs,  we  may  make  impossible  the  correction  of  errors  in  large,  evolving  data 
bases  We  wrll  find  such  techniques  not  just  desirable,  but  necessary,  when  we  attempt  to 
build  truly  complex  programs  and  systems  Lest  we  follow  the  tradition  of  huge. 
Incomprehensible  systems  which  sp«  vised  Software  Engineering,  we  must,  in  Gera’d 
Sussman's  term,  make  "responsible"  programs  which  can  explain  their  actions  and 
conclusions  to  a  user  (Cf  H6J ) 
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Figure  1.  A  sample  system  of  six  nodes  and 
seven  Justifications. 


system  of  Figure  1.  Dashed  entries  are  empty.  All  other 
entries  are  lists  of  nodes  In  the  dependency  relationship 
to  the  node  given  at  the  top  of  the  column. 


